News for hackers. Stuff that matters.

A comment on System Down: A systemd-journald exploit. Parent comment

Re:System Down: A systemd-journald exploit by vesinisa on Thursday January 10, 2019 @11:06AM (#18874830)
Despite being a security critical component, systemd doesn't even seem to have a proper security announcement release process. For example, there was a remote code execution vuln discovered in their DHCP client in October (CVE-2018-15688).[1] The issue was fixed with a GitHub PR that failed to mention that the changes fix a remote exec vulnerability: https://github.com/systemd/systemd/pull/10518

They also have a rather informal release process. Their "release notes" are just a very long NEWS file[2] in the git repo, with notes of trivial and critical changes mishmashed together. And for some reason, to this date there is not a mention of the DHCP remote exec vuln fixed in the latest release.

I must say I don't feel too good about this project's attitude towards security. Compare this to e.g. Apache.

[1] https://www.theregister.co.uk/2018/10/26/systemd_dhcpv6_rce/

[2] https://github.com/systemd/systemd/blob/master/NEWS

[ Parent | on HN ]
Re:System Down: A systemd-journald exploit by dalai on Thursday January 10, 2019 @11:36AM (#18875169)
That was not the first time either:

https://github.com/systemd/systemd/issues/5144

[ Parent | on HN ]
Re:System Down: A systemd-journald exploit by dijit on Thursday January 10, 2019 @11:40AM (#18875213)
Or relying on other people to report the issues so that people patch.

https://www.openwall.com/lists/oss-security/2017/01/24/4

[ Parent | on HN ]
Re:System Down: A systemd-journald exploit by the_duke on Thursday January 10, 2019 @01:03PM (#18876220)
The tone of discussion there indeed suggests a very lax / "meh" attitude towards vulnerabilities.
[ Parent | on HN ]
Re:System Down: A systemd-journald exploit by dralley on Friday January 11, 2019 @12:01AM (#18881134)
While I agree that it isn't ideal -- it should be pointed out that neither does the kernel itself.
[ Parent | on HN ]
Re:System Down: A systemd-journald exploit by lima on Thursday January 10, 2019 @01:15PM (#18876351)
systemd is a low-level building piece for distributions - the distros are doing end-user changelogs and security notices. The target audience for their NEWS file are upstream maintainers, not users.
[ Parent | on HN ]