Re: CVE-2026-28372: Telnetd Vulnerability Report

[Solar Designer <solar () openwall com>]

Hi Guillem and Salvatore,

On Fri, Feb 27, 2026 at 01:09:57PM +0100, Guillem Jover wrote:
> On Tue, 2026-02-24 at 11:57:34 +0200, Ron Ben Yizhak wrote:
> > I’d like to ensure we follow the standard CVE process here. Standard
> > practice dictates that a CVE is issued per individual fix. Generally, once
> > a fix is merged and released, it is assigned its own CVE. Even if that fix
> > is later bypassed, the original merge stands as a unique event in the
> > codebase, meaning we should issue two separate CVEs rather than grouping
> > them.
>
> Salvatore Bonaccorso from the Debian Security Team got a CVE assigned
> for this, see <https://www.cve.org/CVERecord?id=CVE-2026-28372>. I'll
> update the Debian packaging on the next upload to point to that.

The CVE description says:

"telnetd in GNU inetutils through 2.7 allows privilege escalation that
can be exploited by abusing systemd service credentials support added to
the login(1) implementation of util-linux in release 2.40. This is
related to client control over the CREDENTIALS_DIRECTORY environment
variable, and requires an unprivileged local user to create a
login.noauth file."

So is this CVE only for the attack vector reported by Ron Ben Yizhak,
and not also for the other attack vector and more general issue reported
by Justin Swartz?

If so, are you going to assign a second CVE for the more general issue?

I am not convinced "the standard CVE process" is exactly as Ron Ben
Yizhak describes it above, but I don't mind doing things in this way.

It sometimes happens that a fix is released as being for a certain CVE,
and then a second CVE has to be assigned for the "incomplete fix", where
the incompleteness of the first fix is the new vulnerability.  But with
no CVE assigned yet, we didn't have to do it this way.  We could have
one CVE for the set of issues, and not treat "the original merge" as
fixing any CVE at all.

But again, I don't mind, and I understand that we also need to enable
researchers to find and report such issues during work hours, which
means making employers happy with credits and CVEs.  It isn't wrong to
have separate CVEs, so we may.

Just need to clarify.

Alexander