Re: Security Vulnerabilities in inetutils telnetd

--000000000000c533280652def78c
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Simon,

Thank you for the quick reply.
Just to confirm, are you sure you'd like me to disclose these POCs in a
public list? We would prefer to send this over a secure channel as this
information could be weaponised and effect current users of inetutils.

Kind regards,
Tal Carmel
Delphos Labs

On Wed, May 27, 2026 at 10:25=E2=80=AFPM Simon Josefsson <[email protected]=
rg>
wrote:

> Tal Carmel <[email protected]> writes:
>
> > Hello,
> >
> > I'm reaching out on behalf of Delphos Labs because we discovered 2
> > vulnerabilities in inetutils.
> >
> > What email address should we use for security disclosures? We have POCs
> > which we would like to send securely.
>
> Hi!  Thanks for studying inetutils.  I believe it is fine to share to
> this public bug-inetutils list, so we all can help work on investigation
> and solutions to problems.
>
> /Simon
>

--000000000000c533280652def78c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><p>Hi Simon, </p>
<p>Thank you for the quick reply.<br>
Just to confirm, are you sure you&#39;d like me to disclose these POCs in a=
 public list? We would prefer to send this over a secure channel as this in=
formation could be weaponised and effect current users of inetutils.</p>
<p>Kind regards,<br>
Tal Carmel<br>
Delphos Labs</p></div><br><div class=3D"gmail_quote gmail_quote_container">=
<div dir=3D"ltr" class=3D"gmail_attr">On Wed, May 27, 2026 at 10:25=E2=80=
=AFPM Simon Josefsson &lt;<a href=3D"mailto:[email protected]">simon@jose=
fsson.org</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=
=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding=
-left:1ex">Tal Carmel &lt;<a href=3D"mailto:[email protected]" target=3D"=
_blank">[email protected]</a>&gt; writes:<br>
<br>
&gt; Hello,<br>
&gt;<br>
&gt; I&#39;m reaching out on behalf of Delphos Labs because we discovered 2=
<br>
&gt; vulnerabilities in inetutils.<br>
&gt;<br>
&gt; What email address should we use for security disclosures? We have POC=
s<br>
&gt; which we would like to send securely.<br>
<br>
Hi!=C2=A0 Thanks for studying inetutils.=C2=A0 I believe it is fine to shar=
e to<br>
this public bug-inetutils list, so we all can help work on investigation<br=
>
and solutions to problems.<br>
<br>
/Simon<br>
</blockquote></div>

--000000000000c533280652def78c--