3 ms·
The postmortem is worth reading: https://poolp.org/posts/2020-01-30/opensmtpd-advisory-dissected/ https://poolp.org/posts/2020-01-30/opensmtpd-advisory-dissec.
by ori_b 4y ago
The postmortem is worth reading:
https://poolp.org/posts/2020-01-30/opensmtpd-advisory-dissected/ https://poolp.org/posts/2020-01-30/opensmtpd-advisory-dissec...
It's worth reading through the systemic mitigations that would make a clone of this bug impossible in the future.
- chasil 4y agoInteresting that the problem was introduced in a major architecture change to external MDAs, invoked with system(), and was specific to mbox format that requires elevated privilege. I think that I will keep this disabled.