| 13 Oct 2022 |
 hexa | in terms of client support | 12:19:23 |
| hexa | oh, my search term was "DHE" and it highlights "ECDHE" as well 🙂 | 12:19:51 |
| hexa | I didn't mean to imply that ECDHE was affected | 12:20:20 |
|  chreekat joined the room. | 12:29:00 |
 vcunat | I wasn't sure, as I could see no other DHE in the image than ECDHE. | 12:43:35 |
 qbit | https://www.openwall.com/lists/oss-security/2022/10/13/5 | 19:35:29 |
| qbit |
The PoC uses mac80211_hwsim to inject the frames, but the vulnerabilities are - to my knowledge - driver-independent, and we assume that they are exploitable over the air.
All the malformed frames are Beacon frames.
| 19:35:38 |
|  julm joined the room. | 22:00:31 |
| hexa | will be fixed along with regular kernel upgrades 🤷 | 22:02:55 |
|  Tom joined the room. | 23:25:07 |
| 14 Oct 2022 |
 K900 | Are they actually not doing a stable release for this? | 06:20:35 |
| K900 | 6.0.1 is still the latest listed for me | 06:20:43 |
|  Nick Cao joined the room. | 11:26:40 |
|  linj joined the room. | 11:28:50 |
| hexa | https://github.com/NixOS/nixpkgs/pull/190340 | 21:56:11 |
| hexa | hedgedoc has a uploaded file enumeration vulnerability | 21:56:25 |
| hexa | but the backport went nowhere | 21:56:32 |
| 15 Oct 2022 |
|  underpantsgnome! changed their display name from underpantsgnome to underpantsgnome!. | 00:36:15 |
 Winter (she/her) | In reply to @hexa:lossy.network
but the backport went nowhere i'll take a look at it as soon as i can | 15:14:45 |
| Winter (she/her) | fix is hopefully simple | 15:14:57 |
| Winter (she/her) | i hope 😅 | 15:15:09 |
 Sandro 🐧 | Maybe if you just get the patch it is | 15:52:32 |
 raitobezarius | https://nixpk.gs/pr-tracker.html?pr=196094 | 21:55:38 |
| hexa | Crash Linux systems over the air (CVE-2022-42722 POC on an ESP32) - https://github.com/jo-m/linux-wifi-ota-crash | 23:52:58 |
| 16 Oct 2022 |
| Winter (she/her) | In reply to @sandro:supersandro.de
Maybe if you just get the patch it is wdym | 00:22:04 |
| Sandro 🐧 | if you try to only backport the hedgedoc commit that fixes the CVE | 00:22:29 |
| Winter (she/her) | In reply to @sandro:supersandro.de
if you try to only backport the hedgedoc commit that fixes the CVE Right.
I'll look into it.
Also: do you remember why that refactor was needed (why the initial package impl started breaking all of a sudden)?
I didn't look at the copy before the refactor so maybe there's something obvious idk. | 00:56:23 |
| Sandro 🐧 | I think I remember that:
yarn2nix is broken and and does not parse correct depedencies and devDependencies from https://github.com/hedgedoc/hedgedoc/blob/1.9.4/package.json.
That is very important since >1.9.0 because they contain conflicting packages and yarn2nix ends up with the wrong package which breaks the frontend editor at runtime | 00:59:55 |
|  joepie91 🏳️🌈 joined the room. | 01:16:43 |
| Winter (she/her) | @hexa @Sandro 🐧 https://github.com/NixOS/nixpkgs/pull/196305 | 18:24:44 |
