[<prev] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20260121130903.ydfe42j5ovq2lnte@jwilk.net>
Date: Wed, 21 Jan 2026 14:09:03 +0100
From: Jakub Wilk <jwilk@...lk.net>
To: oss-security@...ts.openwall.com
Subject: Re: GNU InetUtils Security Advisory: remote
authentication by-pass in telnetd
* Alexander Bochmann <ab@...ts.gxis.de>, 2026-01-21 00:16:
>...on 2026-01-20 15:00:07, Simon Josefsson wrote:
>
>>Vulnerable versions: GNU InetUtils since version 1.9.3 up to and
>>including version 2.7.
>
>Looking at Debian, this gets even more hilarious... Their
>changelog for inetutils has:
>
>>inetutils (2:1.9.4-7) unstable; urgency=medium
>>[..]
>> * Take several patches from upstream git master:
>>[..]
>> - 0028-telnetd-Scrub-USER-from-environment.patch
I think this is unrelated.
The bug is reproducible with inetutils-telnetd 2:1.9.4-7 too.
--
Jakub Wilk
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
