Closed danfruehauf closed 4 years ago
I understand some people are going to be very unhappy with it. However I hope to add -L
and -R
options.
See also: https://bugzilla.redhat.com/show_bug.cgi?id=1803499
@lhw This should be urgently deployed. I'll tag it as 1.2.11
@danfruehauf can you please request a CVE as needed for the privilege escalation flaw via https://cveform.mitre.org/ ?
@carnil I've requested a CVE ID and will post it here once I've heard back from them.
@kobus-v-schoor was there any news on the CVE assignment?
@danfruehauf https://bugzilla.redhat.com/show_bug.cgi?id=1803499 is not publicly accessible, possible to open that up? This might be blocking the CVE assignment from MITRE if they have not enough context.
CVE-2020-9355 was assigned for this issue.
Darn. I can't -D anymore. Is there some way to add this? :(
The PR removed the extra options, but left in the README section and the image, giving the false impression this is still supported.
On the same topic, I'd really like to have -L
back, would you be open to merge a very restricted input field that just allows the user to append valid -L
blocks?
After analyzing some privilege escalation possibilites, it was decided it is best to remove extra options