Precedence: list
MIME-Version: 1.0
In-Reply-To: <5b9d10ec.1c69fb81.2428d.cfe4SMTPIN_ADDED_BROKEN@mx.google.com>
References: <5b9d10ec.1c69fb81.2428d.cfe4SMTPIN_ADDED_BROKEN@mx.google.com>
From: Daniel Isaksen <d@duniel.no>
Date: Sat, 15 Sep 2018 16:29:46 +0200
Message-ID: <CAFWK1CB7mp=gWGaTpv3TJunGSgOKCKKVLUbc5k9dbKodJyv1kg@mail.gmail.com>
Subject: Re: [alpine-user] apk MITM bug
To: fm+alpine+user+list@phosphorusnetworks.com
Cc: alpine-user@lists.alpinelinux.org
Content-Type: multipart/alternative; boundary="000000000000d3c4270575e9c66a"

--000000000000d3c4270575e9c66a
Content-Type: text/plain; charset="UTF-8"

A CVE is pending for this.

Also see:
https://alpinelinux.org/posts/Alpine-3.8.1-released.html
https://git.alpinelinux.org/cgit/apk-tools/commit/?id=6484ed9849f03971eb48ee1fdc21a2f128247eb1

-----
Sincerely / Med vennlig hilsen,
Daniel Isaksen <d@duniel.no> (https://duniel.no)

On Sat, Sep 15, 2018 at 4:01 PM, Fabio Martins <
fm+alpine+user+list@phosphorusnetworks.com> wrote:

>
> Just read:
>
> https://www.theregister.co.uk/2018/09/15/alpine_linux_bug/
>
> ..."The vulnerability lies in the way apk unpacks archives and deals with
> suspicious code. Justicz found that if the malware could be hidden within
> the package's commit_hooks directory, it would escape the cleanup and
> could then be executed as normal."
>
> Didn't found nothing here:
>
> https://bugs.alpinelinux.org/projects/alpine/issues
>
> Am I missing something?
>
> cheers.
>
> --
> Fabio Martins
> PHOSPHORUS NETWORKS
> https://phosphorusnetworks.com/en/
>
>
>
> ---
> Unsubscribe:  alpine-user+unsubscribe@lists.alpinelinux.org
> Help:         alpine-user+help@lists.alpinelinux.org
> ---
>
>

--000000000000d3c4270575e9c66a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr">A CVE is pending for thi=
s.<div><br></div><div>Also see:</div><div><a href=3D"https://alpinelinux.or=
g/posts/Alpine-3.8.1-released.html">https://alpinelinux.org/posts/Alpine-3.=
8.1-released.html</a></div><div><div><a href=3D"https://git.alpinelinux.org=
/cgit/apk-tools/commit/?id=3D6484ed9849f03971eb48ee1fdc21a2f128247eb1">http=
s://git.alpinelinux.org/cgit/apk-tools/commit/?id=3D6484ed9849f03971eb48ee1=
fdc21a2f128247eb1</a></div></div></div></div></div><div class=3D"gmail_extr=
a"><br clear=3D"all"><div><div class=3D"gmail_signature" data-smartmail=3D"=
gmail_signature"><div dir=3D"ltr"><div>-----</div><div>Sincerely / Med venn=
lig hilsen,</div><div>Daniel Isaksen &lt;<a href=3D"mailto:d@duniel.no" tar=
get=3D"_blank">d@duniel.no</a>&gt; (<a href=3D"https://duniel.no" target=3D=
"_blank">https://duniel.no</a>)</div></div></div></div>
<br><div class=3D"gmail_quote">On Sat, Sep 15, 2018 at 4:01 PM, Fabio Marti=
ns <span dir=3D"ltr">&lt;<a href=3D"mailto:fm+alpine+user+list@phosphorusne=
tworks.com" target=3D"_blank">fm+alpine+user+list@phosphorusnetworks.com</a=
>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 =
0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
Just read:<br>
<br>
<a href=3D"https://www.theregister.co.uk/2018/09/15/alpine_linux_bug/" rel=
=3D"noreferrer" target=3D"_blank">https://www.theregister.co.uk/<wbr>2018/0=
9/15/alpine_linux_bug/</a><br>
<br>
...&quot;The vulnerability lies in the way apk unpacks archives and deals w=
ith<br>
suspicious code. Justicz found that if the malware could be hidden within<b=
r>
the package&#39;s commit_hooks directory, it would escape the cleanup and<b=
r>
could then be executed as normal.&quot;<br>
<br>
Didn&#39;t found nothing here:<br>
<br>
<a href=3D"https://bugs.alpinelinux.org/projects/alpine/issues" rel=3D"nore=
ferrer" target=3D"_blank">https://bugs.alpinelinux.org/<wbr>projects/alpine=
/issues</a><br>
<br>
Am I missing something?<br>
<br>
cheers.<br>
<span class=3D"HOEnZb"><font color=3D"#888888"><br>
-- <br>
Fabio Martins<br>
PHOSPHORUS NETWORKS<br>
<a href=3D"https://phosphorusnetworks.com/en/" rel=3D"noreferrer" target=3D=
"_blank">https://phosphorusnetworks.<wbr>com/en/</a><br>
<br>
<br>
<br>
---<br>
Unsubscribe:=C2=A0 <a href=3D"mailto:alpine-user%2Bunsubscribe@lists.alpine=
linux.org">alpine-user+unsubscribe@lists.<wbr>alpinelinux.org</a><br>
Help:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<a href=3D"mailto:alpine-user%2Bhelp=
@lists.alpinelinux.org">alpine-user+help@lists.<wbr>alpinelinux.org</a><br>
---<br>
<br>
</font></span></blockquote></div><br></div>

--000000000000d3c4270575e9c66a--


---
Unsubscribe:  alpine-user+unsubscribe@lists.alpinelinux.org
Help:         alpine-user+help@lists.alpinelinux.org
---