acme.sh
acme.sh copied to clipboard
acmesh-official
CVE request for RCE discovered in #4659
For the bug discovered in #4659, could the acmesh team request a CVE since it’s effectively allowing RCE?
I believe some of the instructions even tell the user to use root with this: https://github.com/acmesh-official/acme.sh/blob/b7caf7a0165d80dd1556b16057a06bb32025066d/README.md?plain=1#L145
I'm searching google on how to request a CVE, sorry, I don't know that yet.
I'm searching google on how to request a CVE, sorry, I don't know that yet.
https://cveform.mitre.org/
There are three questions:
- The acme.sh arbitrary code execution vulnerability, this been fixed, which is good.
- Whether HiCA has used this vulnerability to execute malicious code, need to respond.
- HiCA claims that it has jointly built an ocsp responder with ssl.com in China, which requires ssl.com to respond, whether it complies with the CPS specification and BR.
@BeSafee the second and third question is not relevant to this bug. AcmeSH isn’t a root program and won’t be handling those. For those you should reach out to the various root programs.
GitHub provides CVE using their own advisory process, see https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/publishing-a-repository-security-advisory.
Going via Mitre is a last resort, so please use the published process.
There are three questions:
- The acme.sh arbitrary code execution vulnerability, this been fixed, which is good.
- Whether HiCA has used this vulnerability to execute malicious code, need to respond.
- HiCA claims that it has jointly built an ocsp responder with ssl.com in China, which requires ssl.com to respond, whether it complies with the CPS specification and BR.
@BeSafee
about [1.], i agree.
for [2.], we have fully source code git log for the challenge responder controller, if you have known familiar auditor and willing to provide audit fee, welcome to review the git log.
and about [3.], ocsp responders management is a widely accepted solution. You may worried by looking at the ICP information subject is a Chinese company, but the domain ownership is controlled by CA so that's compliant to CA's CPS or CA/B Forum's BR. many CAs have OCSP responders interfaced by China ICP filled domain including sectigo、digicert and globalsign. So we believe it's fully compliant with ca/b forum BR. And is this associated with RCE or this ISSUE?
about [1.], i agree.
Sorry, you don't. You/your company/whathever your business is, was the first to detect AND exploit that RCE possibility; instead of reporting it, you were exploiting it (for the good, maybe, but exploiting nevertheless).
My advice, please stop justifying about something that can't be justified.
