CVE-2023-40547 – avoid incorrectly trusting HTTP headers

Re:CVE-2023-40547 – avoid incorrectly trusting HTTP headers by nailer on Thursday January 25, 2024 @02:25PM (#39133890)

Thanks! I was looking for the word 'sign' and couldn't find it.

I now think I was wrong earlier.

Summarizing https://www.gnu.org/licenses/gpl-3.0.html:

> The information (ie 'methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work') must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.

The purpose of allowing signing is exactly to ensure modified code does not function in that environment.

Yes MS (and you) would be right. GPLv2, BSD or MIT would be fine but GPLv3 would not.

-----------------------------------

Edit reply to baobun (rate limit means I can't post)

I did think about that, but:

> continued functioning of the modified object code

is vague. Does it mean a new firmware binary should continue working on the same device as the unmodified predecessor or using is a new device (that allows arbitrary entities to sign) considered to be "continued functioning"?

[ Parent | on HN ]

Re:CVE-2023-40547 – avoid incorrectly trusting HTTP headers by baobun on Thursday January 25, 2024 @03:12PM (#39134555)

Not exactly. AshamedCaptain gets it. If the device can be configured to trust a user-supplied key instead of or in addition to Microsoft's, there is no need to provide any keys. This is up to the hardware supplier.

https://news.ycombinator.com/item?id=39134059

https://news.ycombinator.com/item?id=39133999

[ Parent | on HN ]

Re:CVE-2023-40547 – avoid incorrectly trusting HTTP headers by nailer on Friday January 26, 2024 @09:26AM (#39142929)

I did reply to this, but had to reply in my existing comment above due to the rate limit.

[ Parent | on HN ]