3 ms·
> Debian patches lead to several possible exploits over the last few years. Which ones? There was the OpenSSL entropy bug, of course, but that was 1. in 2006,
by yjftsjthsd-h 2y ago
> Debian patches lead to several possible exploits over the last few years.
Which ones? There was the OpenSSL entropy bug, of course, but that was 1. in 2006, and 2. run by upstream so feels a bit unfair.
- Yasuraka 2y agoI have to admit that I never compiled a list of this type and it seems exceedingly difficult to find useful search results. I couldn't dig up the examples I had in mind from the last 2 years, but stumbled upon others I didn't know of yet in turn, e.g. RCE via Redis, no special config required: > This post describes how I broke the Redis sandbox, but only for Debian and Debian-derived Linux distributions. Upstream Redis is not affected. That makes it a Debian vulnerability, not a Redis one. The culprit, if you will, is dynamic linking https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rc...