[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <4507d265.15af61.196b076c543.Coremail.whistle@mail.ustc.edu.cn>
Date: Thu, 8 May 2025 23:14:55 +0800 (GMT+08:00)
From: whistle@...l.ustc.edu.cn
To: musl@...ts.openwall.com
Subject: Potential Injection Vulnerability in _vsyslog Function
In the current _vsyslog function, if the log contains characters like \r or \n, according to CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection'), this could potentially lead to an injection vulnerability.
When using musl, would it be safer to explicitly handle \r and \n here as an extra security measure?
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
