Re: vulnerabilities in busybox tar and cpio tools

[Solar Designer <solar () openwall com>]

On Thu, Apr 24, 2025 at 07:09:44PM -0400, Demi Marie Obenour wrote:
> On 4/24/25 3:09 AM, Albert Veli wrote:
> > On Wed, Apr 23, 2025 at 10:51 PM Salvatore Bonaccorso <carnil () debian org> wrote:
> > > FTR, this one has assigned CVE-2025-46394
> > > ...
> > > FTR, this one has CVE-2024-58251 assigned.
> >
> > From what I can tell the latest release is busybox-1.37.0. Are these fixed
> > in this release? If not, do you have any link to patches I can apply to fix
> > these issues?
> >
> > Regards,
> > Albert
>
> This message was marked as spam by GMail.  The ARC-Authentication-Results
> header indicates that the mailing list is not configured in a DMARC-compatible
> way.  Specifically, the mailing list did not rewrite the From: header but did
> modify the message body, so the DKIM signature check failed.

This was a special case - DKIM-breaking message body modification
shouldn't normally happen here.

However, the list is indeed not DMARC-compatible: we insert
[oss-security] into the Subject when it's not already near the beginning
of that header (may break DKIM), and we relay messages from the list
server's IP address (may be against the From header domain's SPF,
although recipient servers may look at envelope-from instead, which we
do rewrite, so SPF will match in that respect).

For now, this is simply how it is.  Most delivery problems occur when
the sender's domain has strict DMARC policy ("p=reject"), so e.g. when
someone from google.com posts, the message doesn't get through to
subscribers on gmail.com.  For gmail.com to gmail.com, everything is
usually "fine" for now.

Yes, we may need to bite the bullet and add From header rewriting.

Alexander