Re: Fixing security vulnerabilities before new releases

Hi,

Óscar Fuentes <[email protected]> writes:

> Eshel Yaron <[email protected]> writes:
>
>>> I'm with you and Óscar on this one but FWIW I was not able to reproduce
>>> the code execution example given by Stefan.  Writing the following in
>>> /tmp/test.el and opening it doesn't do anything for me (I'm on current
>>> master):
>>
>> [...]
>>
>>> What am I missing?
>>
>> I can readily reproduce it here, so your guess is as good as mine...
>> Did you try with emacs -Q?  Perhaps it's something in your config,
>> like a non-default value of vc-handled-backends, or maybe you have
>> trust-manager-mode enabled? :)
>
> I can reproduce with emacs -Q, but not with my config. No
> trust-manager-mode here.
>
> I'm on igc HEAD (397afb025b9).

Thanks for checking.  I'm curious to hear which setting
in your config affects it, if you figure it out.

BTW, I see that Stefan just pushed some changes to master that
(among other things) mitigate this vulnerability.
The Emacs 31 release branch is still vulnerable though.


Best,

Eshel