Hi Guillem and Salvatore, On Fri, Feb 27, 2026 at 01:09:57PM +0100, Guillem Jover wrote: > On Tue, 2026-02-24 at 11:57:34 +0200, Ron Ben Yizhak wrote: > > I’d like to ensure we follow the standard CVE process here. Standard > > practice dictates that a CVE is issued per individual fix. Generally, once > > a fix is merged and released, it is assigned its own CVE. Even if that fix > > is later bypassed, the original merge stands as a unique event in the > > codebase, meaning we should issue two separate CVEs rather than grouping > > them. > > Salvatore Bonaccorso from the Debian Security Team got a CVE assigned > for this, see <https://www.cve.org/CVERecord?id=CVE-2026-28372>. I'll > update the Debian packaging on the next upload to point to that.
The CVE description says: "telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. This is related to client control over the CREDENTIALS_DIRECTORY environment variable, and requires an unprivileged local user to create a login.noauth file." So is this CVE only for the attack vector reported by Ron Ben Yizhak, and not also for the other attack vector and more general issue reported by Justin Swartz? If so, are you going to assign a second CVE for the more general issue? I am not convinced "the standard CVE process" is exactly as Ron Ben Yizhak describes it above, but I don't mind doing things in this way. It sometimes happens that a fix is released as being for a certain CVE, and then a second CVE has to be assigned for the "incomplete fix", where the incompleteness of the first fix is the new vulnerability. But with no CVE assigned yet, we didn't have to do it this way. We could have one CVE for the set of issues, and not treat "the original merge" as fixing any CVE at all. But again, I don't mind, and I understand that we also need to enable researchers to find and report such issues during work hours, which means making employers happy with credits and CVEs. It isn't wrong to have separate CVEs, so we may. Just need to clarify. Alexander
