From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: Ihor Radchenko Newsgroups: gmane.emacs.devel,gmane.comp.security.oss.general Subject: Re: Is CVE-2024-30203 bogus? Date: Mon, 08 Apr 2024 18:44:21 +0000 Message-ID: <87y19nu22i.fsf@localhost> References: <874jccjpvy.fsf@melete.silentflame.com> Mime-Version: 1.0 Content-Type: text/plain Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="12156"; mail-complaints-to="usenet@ciao.gmane.io" Cc: emacs@packages.debian.org, emacs-devel@gnu.org, oss-security@lists.openwall.com To: Sean Whitton Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Mon Apr 08 20:44:31 2024 Return-path: Envelope-to: ged-emacs-devel@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1rttyp-0002yZ-59 for ged-emacs-devel@m.gmane-mx.org; Mon, 08 Apr 2024 20:44:31 +0200 Original-Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1rttyU-0002O7-DT; Mon, 08 Apr 2024 14:44:10 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1rttyS-0002Ng-0z for emacs-devel@gnu.org; Mon, 08 Apr 2024 14:44:08 -0400 Original-Received: from mout02.posteo.de ([185.67.36.66]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1rttyP-0004EP-LV for emacs-devel@gnu.org; Mon, 08 Apr 2024 14:44:07 -0400 Original-Received: from submission (posteo.de [185.67.36.169]) by mout02.posteo.de (Postfix) with ESMTPS id 4090E240105 for ; Mon, 8 Apr 2024 20:44:03 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=posteo.net; s=2017; t=1712601843; bh=HN50RhQ4DavJ5j1JuTEdb67mhQDpx3Il+fDCal71eCk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type: From; b=CFBxcBpDcgkZQhgccEVmEvWDDYphh2oaTUn/av/ibVAan79UMbsXC7s8OROzg9CcJ nUoiPh+FokrZHk5uMFwy9JMLw87ah+GH5Urw3KmTZ/QdQWdoB2fsve3uS44tV53/5R hQNCXVQDQXjrT1mI/IrySG6FJlSDIfZCB66Cj44DwY+HV65KqFxmkdSZc3CTu5V8wY PmGO/3YpNRpapV/zaUE7c6PzUSH44uiR1iDkV9hC0EFUZsJq88BuDqYWD9PMV0UTVM 0LErYe7v05tanvx67c80nOE0BfcKVsa7y6CCm4AGqJLrxEBNZNjgJhgRTM8L2PSCTm 4jk/rg74bQ4Kw== Original-Received: from customer (localhost [127.0.0.1]) by submission (posteo.de) with ESMTPSA id 4VCyfp2Ps1z6twd; Mon, 8 Apr 2024 20:44:02 +0200 (CEST) In-Reply-To: <874jccjpvy.fsf@melete.silentflame.com> Received-SPF: pass client-ip=185.67.36.66; envelope-from=yantar92@posteo.net; helo=mout02.posteo.de X-Spam_score_int: -43 X-Spam_score: -4.4 X-Spam_bar: ---- X-Spam_report: (-4.4 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Xref: news.gmane.io gmane.emacs.devel:317624 gmane.comp.security.oss.general:30087 Archived-At: Sean Whitton writes: > The description for CVE-2024-30203 is > > In Emacs before 29.3, Gnus treats inline MIME contents as trusted. Before Emacs 29.3, there was no concept of trusted or untrusted content in Emacs. We introduced it specifically to control whether we allow running LaTeX on the contents of a given buffer. (And even in Emacs 29.3, the concept of untrusted contents is not yet official) So, at least the title is misleading. > and for CVE-2024-30204 is > > In Emacs before 29.3, LaTeX preview is enabled by default for e-mail > attachments. This is closer to what was happening. Note that LaTeX preview itself was not a problem. The problem was that we executed actual latex program without user query with input taken from buffer text to generate the previews (using the default settings). LaTeX input can be specifically constructed to cause DOS when using LaTeX compiler, which is especially dangerous when the input is coming from emails. Also, only GNUS and MUA clients re-using gnus libs (at least, notmuch and mu4e) were affected. Not rmail, AFAIK. > ... > I think it's the first one -- can you confirm? I hope that the above clarified things. -- Ihor Radchenko // yantar92, Org mode contributor, Learn more about Org mode at . Support Org development at , or support my work at