public inbox for gentoo-dev@lists.gentoo.org
 help / color / mirror / Atom feed
Search results ordered by [date|relevance]  view[summary|nested|Atom feed]
thread overview below | download: 
* Re: [gentoo-dev] [News item review] Exim >=4.94 transports: tainted not permitted
  @ 2021-05-06 13:01 99% ` Andreas K. Huettel
  0 siblings, 0 replies; 1+ results
From: Andreas K. Huettel @ 2021-05-06 13:01 UTC (permalink / raw
  To: gentoo-dev

[-- Attachment #1: Type: text/plain, Size: 1260 bytes --]

Am Sonntag, 2. Mai 2021, 11:56:34 CEST schrieb Fabian Groffen:
> Title: Exim >=4.94 disallows tainted variables in transport
> configurations Author: Fabian Groffen <grobian@gentoo.org>
> Posted: 2021-05-??
> Revision: 1
> News-Item-Format: 2.0
> Display-If-Installed: mail-mta/exim
> 
> Since the release of Exim-4.94, transports refuse to use tainted
> data in constructing a delivery location.  If you use this in your
> transports, your configuration will break, causing errors and
> possible downtime.
> 
> Particularly, the use of $local_part in any transport, should likely
> be updated with $local_part_data.  Check your local_delivery
> transport, which historically used $local_part.
> 
> Unfortunately there is not much documentation on "tainted" data for
> Exim[1], and to resolve this, non-official sources need to be used,
> such as [2] and [3].

This is a safety mechanism that is part of Perl (essentially a way of 
tracking data that is derived from "insecure" sources).

So it probably would make sense to at least point towards that concept 
in Perl.

https://perldoc.perl.org/perlsec



-- 
Andreas K. Hüttel
dilfridge@gentoo.org
Gentoo Linux developer
(council, toolchain, base-system, perl, libreoffice)

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 981 bytes --]

^ permalink raw reply	[relevance 99%]

Results 1-1 of 1 | reverse | options above
-- pct% links below jump to the message on this page, permalinks otherwise --
2021-05-02  9:56     [gentoo-dev] [News item review] Exim >=4.94 transports: tainted not permitted Fabian Groffen
2021-05-06 13:01 99% ` Andreas K. Huettel

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox