Received-SPF: pass (google.com: domain of oss-security-return-30001-linux.lists.archive=gmail.com@lists.openwall.com designates 193.110.157.125 as permitted sender) client-ip=193.110.157.125;
Mailing-List: contact oss-security-help@lists.openwall.com; run by ezmlm
Precedence: bulk
Reply-To: oss-security@lists.openwall.com
Feedback-ID: i23c04076:Fastmail
From: Sean Whitton <spwhitton@spwhitton.name>
To: Salvatore Bonaccorso <carnil@debian.org>
Cc: oss-security@lists.openwall.com,  emacs@packages.debian.org,
  emacs-devel@gnu.org
In-Reply-To: <Zhafa3wcZONJX-_k@eldamar.lan> (Salvatore Bonaccorso's message of
	"Wed, 10 Apr 2024 16:17:15 +0200")
References: <874jccjpvy.fsf@melete.silentflame.com> <87y19nu22i.fsf@localhost>
	<87bk6he8h4.fsf_-_@melete.silentflame.com> <87o7ahe85l.fsf@localhost>
	<Zhafa3wcZONJX-_k@eldamar.lan>
Date: Thu, 11 Apr 2024 17:13:26 +0800
Message-ID: <87y19kcle1.fsf@melete.silentflame.com>
User-Agent: Gnus/5.13 (Gnus v5.13)
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
	micalg=pgp-sha512; protocol="application/pgp-signature"
Subject: Re: [oss-security] Re: Is CVE-2024-30203 bogus? (Emacs)

--=-=-=
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

Hello,

On Wed 10 Apr 2024 at 04:17pm +02, Salvatore Bonaccorso wrote:

> Note that the CVE assignment (by MITRE as assigning CNA) for
> CVE-2024-30203 is explicitly as follows:
>
>> In Emacs before 29.3, Gnus treats inline MIME contents as trusted.
>
> associated with:
>
> https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=3Demacs-29&id=3D937=
b9042ad7426acdcca33e3d931d8f495bdd804

This commit doesn't fix anything at all, just fyi.

> If you think the CVE assignment is not valid, then you might ask for a
> REJECT on https://cveform.mitre.org/ .

Okay, I'll do that, thanks.

=2D-=20
Sean Whitton

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQJNBAEBCgA3FiEEm5FwB64DDjbk/CSLaVt65L8GYkAFAmYXqbYZHHNwd2hpdHRv
bkBzcHdoaXR0b24ubmFtZQAKCRBpW3rkvwZiQAlBEAC8DAT6MA2SN9FbTFWhtKZq
im0N65ds0UX35A6kGFDH3DAb+DMGKwrp/cB393MppOpFDknZ0Wwv9CdCDuOsFGuY
U4rcgDSPJBBDNkJf+UO0neo9wCNicQDWIx/8hYwqAg2U/cYjx49fnm5ITWfHTEUB
ZPT4dk1RIOdmiz7fhxigCDP86f6KLDXijAn66w6BUYv7Mn7CzYg2FB1XeEKkXpJj
IXSHi8mqnMxLaVB3igMws+G9yoIDdKuHay4gFFxp7uI1sgXbjtCYHRFV9ZHA5y25
+xoAzPjjxkqtF2PiwDKQLZhg4Ef3ACWb2ZMaB4kPmXzfMoNm4ZQ45kIEwzbL3VAs
PLmx52WiUPisvwouOnGOVHzRCqvElhKvPOq6q6uCoqhDe1qhGh6K6kzimhz3PY0q
xIfLqIWfdNJhH/o6krg+V3pMxqD/i0BUHlejrR9fyMjdDFK0MTLM5E7j1W8RewQb
CFmIqU7SfdTrJmS7seysCs+Qex2AH/D0kxfDgWYqbDUAZT0YGUmsDH+ssIXa5dqj
rEE7ksrz+4fviNZQKs6zbQACSJYxSMatYtwAuKQ0OnDjWGtAVUCkabMCapP/Thpu
FFsXnLtQ12b1/MdwLeG2dEOTrSSWV3hxk8IPL+9sRd629JBP4MaYttMB9Fy8kF4V
7+4XPBdvZRX8hSBHBd2cqw==
=/D6w
-----END PGP SIGNATURE-----
--=-=-=--