New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

`crypt_protected_headers_write` should be removed, or at least default to `yes` #4236

Open

alejandro-colomar opened this issue Apr 8, 2024 · 2 comments · Fixed by #4227

Labels

bug:upstream topic:security type:bug

Member

alejandro-colomar commented Apr 8, 2024

As seen in recently reported security vulnerabilities, we need to protect more headers.

Link: #4223
Link: #4226

This makes me wonder...

crypt_protected_headers_write defaults to no. This is insecure. Is there any reason why we would want to support the feature?

I strongly suggest:

Change the default behavior to yes. This is a silent breaking change.

And secondarily, it might be good to

Remove the variable. This is a Breaking Change.

Although the latter suggestion would be more controversial.

The text was updated successfully, but these errors were encountered:

alejandro-colomar added bug:upstream topic:security type:bug labels

alejandro-colomar changed the title ~~crypt_protected_headers_write should be removed, or at least ignored~~ crypt_protected_headers_write should be removed, or at least default to yes

Member

flatcap commented Apr 8, 2024

Change the default behavior to yes

That sounds reasonable...

Remove the variable

We can easily do that too.
The config system has a flag D_INTERNAL_DEPRECATED which means options can be silently ignored.

Member Author

alejandro-colomar commented Apr 8, 2024

Change the default behavior to yes

That sounds reasonable...

Remove the variable

We can easily do that too. The config system has a flag D_INTERNAL_DEPRECATED which means options can be silently ignored.

Hmmm, sounds good! I'll add those changes to the current PR (#4227).

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Change default to 'yes'

d1bfdab

Link: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Remove variable

1e7fded

Closes: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Change default to 'yes'

43b7780

Link: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Remove variable

9a0fcce

Closes: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Change default to 'yes'

a63efa0

Link: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Remove variable

165cc2b

Closes: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar linked a pull request

that will close this issue

Protect more header fields #4227

Merged

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          ncrypt/crypt.c: Don't weed protected headers

cb6ab8a

They are part of the crypto message, which means the sender considers
them part of the important data, and should not be carelessly weeded.

Link: <neomutt#4223>
Link: <neomutt#4226>
Link: <neomutt#4227>
Link: <neomutt#4236>
Link: <neomutt#4237>
Cc: Richard Russon <rich@flatcap.org>
Cc: наб <nabijaczleweli@nabijaczleweli.xyz>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Change default to 'yes'

b6ad788

Link: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Remove variable

2da88ec

Closes: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar mentioned this issue

Change $crypt_protected_headers_write default to 'yes' and then set it in stone (remove it) #4248

Closed

flatcap pushed a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Change default to 'yes'

Link: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

flatcap pushed a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Remove variable

54e3a05

Closes: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

flatcap pushed a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Change default to 'yes'

6fa6f83

Link: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

flatcap pushed a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Remove variable

fd92f5f

Closes: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

flatcap pushed a commit to alejandro-colomar/neomutt that referenced this issue


          ncrypt/crypt.c: Don't weed protected headers

75ca2e1

They are part of the crypto message, which means the sender considers
them part of the important data, and should not be carelessly weeded.

Link: <neomutt#4223>
Link: <neomutt#4226>
Link: <neomutt#4227>
Link: <neomutt#4236>
Link: <neomutt#4237>
Cc: Richard Russon <rich@flatcap.org>
Cc: наб <nabijaczleweli@nabijaczleweli.xyz>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_weed: Add variable

78e1bcf

Protected header fields are part of the crypto message, which means the
sender considers them part of the important data, and should not be
carelessly weeded.

If the user want to do it, allow them via this variable, but default to
not weeding them.

Link: <neomutt#4223>
Link: <neomutt#4226>
Link: <neomutt#4227>
Link: <neomutt#4236>
Link: <neomutt#4237>
Cc: Richard Russon <rich@flatcap.org>
Cc: наб <nabijaczleweli@nabijaczleweli.xyz>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar linked a pull request

that will close this issue

Change $crypt_protected_headers_write default to 'yes' and then set it in stone (remove it) #4248

Closed

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Change default to 'yes'

4367acd

Link: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Remove variable

5c7bf02

Closes: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Change default to 'yes'

Link: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Remove variable

56346cf

Closes: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Change default to 'yes'

f1312da

Link: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Remove variable

38f4e28

Closes: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

flatcap pushed a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Change default to 'yes'

d1bcddf

Link: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

flatcap pushed a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Remove variable

80cf4bb

Closes: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

flatcap pushed a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_weed: Add variable

a5a4540

Protected header fields are part of the crypto message, which means the
sender considers them part of the important data, and should not be
carelessly weeded.

If the user want to do it, allow them via this variable, but default to
not weeding them.

Link: <neomutt#4223>
Link: <neomutt#4226>
Link: <neomutt#4227>
Link: <neomutt#4236>
Link: <neomutt#4237>
Cc: Richard Russon <rich@flatcap.org>
Cc: наб <nabijaczleweli@nabijaczleweli.xyz>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

flatcap pushed a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Change default to 'yes'

8a6fbdc

Link: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

flatcap pushed a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Remove variable

b370564

Closes: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_weed: Add variable

ed1fc00

Protected header fields are part of the crypto message, which means the
sender considers them part of the important data, and should not be
carelessly weeded.

If the user want to do it, allow them via this variable, but default to
not weeding them.

Link: <neomutt#4223>
Link: <neomutt#4226>
Link: <neomutt#4227>
Link: <neomutt#4236>
Link: <neomutt#4237>
Cc: Richard Russon <rich@flatcap.org>
Cc: наб <nabijaczleweli@nabijaczleweli.xyz>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Change default to 'yes'

f4703ed

Link: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Remove variable

eabce0f

Closes: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Change default to 'yes'

2fd4f3e

Link: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Remove variable

e3ae97d

Closes: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_weed: Add variable

055d442

Protected header fields are part of the crypto message, which means the
sender considers them part of the important data, and should not be
carelessly weeded.

If the user want to do it, allow them via this variable, but default to
not weeding them.

Link: <neomutt#4223>
Link: <neomutt#4226>
Link: <neomutt#4227>
Link: <neomutt#4236>
Link: <neomutt#4237>
Cc: Richard Russon <rich@flatcap.org>
Cc: наб <nabijaczleweli@nabijaczleweli.xyz>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Change default to 'yes'

dc32b3b

Link: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Remove variable

Closes: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Change default to 'yes'

fb97771

Link: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Remove variable

d428f2c

Closes: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_weed: Add variable

66625aa

Protected header fields are part of the crypto message, which means the
sender considers them part of the important data, and should not be
carelessly weeded.

If the user want to do it, allow them via this variable, but default to
not weeding them.

Link: <neomutt#4223>
Link: <neomutt#4226>
Link: <neomutt#4227>
Link: <neomutt#4236>
Link: <neomutt#4237>
Cc: Richard Russon <rich@flatcap.org>
Reviewed-by: наб <nabijaczleweli@nabijaczleweli.xyz>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_weed: Add variable

1e23dbe

Protected header fields are part of the crypto message, which means the
sender considers them part of the important data, and should not be
carelessly weeded.

If the user want to do it, allow them via this variable, but default to
not weeding them.

Link: <neomutt#4223>
Link: <neomutt#4226>
Link: <neomutt#4227>
Link: <neomutt#4236>
Link: <neomutt#4237>
Cc: Richard Russon <rich@flatcap.org>
Reviewed-by: наб <nabijaczleweli@nabijaczleweli.xyz>
Cc: Pietro Cerutti <gahr@gahr.ch>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Change default to 'yes'

f3acf94

Link: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Reviewed-by: наб <nabijaczleweli@nabijaczleweli.xyz>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

flatcap pushed a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Change default to 'yes'

a5ed684

Link: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Reviewed-by: наб <nabijaczleweli@nabijaczleweli.xyz>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

flatcap pushed a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_weed: Add variable

a59ee02

Protected header fields are part of the crypto message, which means the
sender considers them part of the important data, and should not be
carelessly weeded.

If the user want to do it, allow them via this variable, but default to
not weeding them.

Link: <neomutt#4223>
Link: <neomutt#4226>
Link: <neomutt#4227>
Link: <neomutt#4236>
Link: <neomutt#4237>
Cc: Richard Russon <rich@flatcap.org>
Reviewed-by: наб <nabijaczleweli@nabijaczleweli.xyz>
Cc: Pietro Cerutti <gahr@gahr.ch>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_weed: Add variable

41e0f12

Protected header fields are part of the crypto message, which means the
sender considers them part of the important data, and should not be
carelessly weeded.

If the user want to do it, allow them via this variable, but default to
not weeding them.

Link: <neomutt#4223>
Link: <neomutt#4226>
Link: <neomutt#4227>
Link: <neomutt#4236>
Link: <neomutt#4237>
Cc: Richard Russon <rich@flatcap.org>
Reviewed-by: наб <nabijaczleweli@nabijaczleweli.xyz>
Cc: Pietro Cerutti <gahr@gahr.ch>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

alejandro-colomar added a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Change default to 'yes'

83b5aad

Link: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Reviewed-by: наб <nabijaczleweli@nabijaczleweli.xyz>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

flatcap pushed a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_weed: Add variable

818381a

Protected header fields are part of the crypto message, which means the
sender considers them part of the important data, and should not be
carelessly weeded.

If the user want to do it, allow them via this variable, but default to
not weeding them.

Link: <neomutt#4223>
Link: <neomutt#4226>
Link: <neomutt#4227>
Link: <neomutt#4236>
Link: <neomutt#4237>
Cc: Richard Russon <rich@flatcap.org>
Reviewed-by: наб <nabijaczleweli@nabijaczleweli.xyz>
Cc: Pietro Cerutti <gahr@gahr.ch>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

flatcap pushed a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_write: Change default to 'yes'

6fc320c

Link: <neomutt#4236>
Link: <neomutt#4223>
Link: <neomutt#4226>
Reviewed-by: наб <nabijaczleweli@nabijaczleweli.xyz>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

flatcap pushed a commit that referenced this issue


          $crypt_protected_headers_write: Change default to 'yes'

43c11a6

Link: <#4236>
Link: <#4223>
Link: <#4226>
Reviewed-by: наб <nabijaczleweli@nabijaczleweli.xyz>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

flatcap pushed a commit to alejandro-colomar/neomutt that referenced this issue


          $crypt_protected_headers_weed: Add variable

0a97c12

Protected header fields are part of the crypto message, which means the
sender considers them part of the important data, and should not be
carelessly weeded.

If the user want to do it, allow them via this variable, but default to
not weeding them.

Link: <neomutt#4223>
Link: <neomutt#4226>
Link: <neomutt#4227>
Link: <neomutt#4236>
Link: <neomutt#4237>
Cc: Richard Russon <rich@flatcap.org>
Reviewed-by: наб <nabijaczleweli@nabijaczleweli.xyz>
Cc: Pietro Cerutti <gahr@gahr.ch>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

flatcap pushed a commit that referenced this issue


          $crypt_protected_headers_weed: Add variable

2251dc9

Protected header fields are part of the crypto message, which means the
sender considers them part of the important data, and should not be
carelessly weeded.

If the user want to do it, allow them via this variable, but default to
not weeding them.

Link: <#4223>
Link: <#4226>
Link: <#4227>
Link: <#4236>
Link: <#4237>
Cc: Richard Russon <rich@flatcap.org>
Reviewed-by: наб <nabijaczleweli@nabijaczleweli.xyz>
Cc: Pietro Cerutti <gahr@gahr.ch>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment