Re: Security issue.

Michał Majchrowicz <[email protected]> Sun, 5 Apr 2026 21:48:52 +0200

Newsgroups	gmane.editors.nano.devel
Message-ID	<[email protected]>

Hello Benno,
Yeah I should have checked. I just was sure I checked the date and it was something like a week or two old :) Anyway checked all the issues. Most of the issues were already patched or unexploitable. Interestingly AI almost convinced me that on of the issues is impossible to exploit but after 2 hours of fighting I think we have a very specific scenario that causes a security issue. It’s not something very serious but just in case I will file a bug report tomorrow. Thank you for having patience I ma still learning how to efficiently use these new tools and how to report issues in open source/GNU projects.
Regards,
—
Michał Majchrowicz / Offensive Security Engineer / PhD eWPTX
PGP: D52A 5289 8256 006D 5E05 BAC6 79EA 0072 F4E1 9D57

AFINE sp. z o.o.
Al. Jerozolimskie 146C, 02-305 Warszawa
https://www.afine.com <https://www.afine.com/>

> Wiadomość napisana przez Benno Schulenberg <[email protected]> w dniu 5 kwi 2026, o godz. 16:57:
> 
> 
> Hello Michał,
> 
> Op 05-04-2026 om 14:11 schreef Michał Majchrowicz:
>> Sorry for not checking with git version but I thought 5.7 was pretty recent
> 
> Yes, 8.7 is pretty recent -- just five months old.  :)  But verifying against
> current git should really be standard practice.
> 
>> I verify all my findings manually as you are probably aware AI tools are pretty unreliable and generate tons of false positives. I will verify rest of my findings with recent git and will get back to you if anything interesting comes.
> 
> Thanks for taking the time to dig into nano!
> 
>> Once again sorry for false report and thanks for your help.
> 
> No worries.
> 
> 
> Benno

signature.asc (application/pgp-signature, 833 B)