โ RNS 1.4.2 released https://pypi.org/project/rns/
๐ฌค rns.recipes
top
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ [PINNED] Critical Security Update: RNS 1.3.9 fixes severe rnsh security flaw โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Started by Mark ยท 11d ago ยท bc7291552be7a58f
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
post-1
โญโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฎ
โ Mark #1 โ
โ bc7291552be7a58f โ
โฐโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฏ
โธ 11d ago
Release is out on Aleph, pip and GitHub.
Update now.
Due to the nature of the issue, I will not disclose any further details for the time
being. Once operators have had time to update, I will of course provide a full report for
transparency. If you use rnsh , update right now.
Earlier today, I became aware of an issue that has been hiding in rnsh
since the very early versions. Most likely, all versions of rnsh are
affected. Regrettably, I did not spot this bug when I merged rnsh into
RNS as an included utility (at version 1.2.0).
Turnaround time on this issue has been approximately 9 hours. As soon as I became aware
of the situation, I dropped everything else to thouroughly analyze it, and implemented a
fix, as well as combing over the code for potential similar bugs. It's looking good now,
but I can assure that I will take another round at the rnsh code once
I've had the chance to catch some sleep.
Important: The new version of rnsh changes default identity file
locations, and these will now be sourced from ~/.rnsh/identity
(initiator) and ~/.rnsh/identity.default (listener). Make sure you copy
your old files to this directory, or specify a custom identity path using the command
line arguments. The --config argument has also been renamed to
--rnsconfig , and the --config argument will now specify the
rnsh configuration directory instead of the RNS configuration directory,
bringing the behavior into alignment with other RNS utilities.
See the release changelog for additional details about this release.
โ 14 โ 1 โค 16
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
post-2
โญโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฎ
โ ButcherPete #2 โ
โ 9b9dd6c8afd015d4 โ
โฐโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฏ
โธ 10d ago
Thank you Mark for your dilligence and speedy update.
โ 1 โ 0 โค 1
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
post-3
โญโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฎ
โ m0nad #3 โ
โ 3324ab182093441e โ
โฐโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฏ
โธ 10d ago
Folks, I just manage to build an exploit to it! It is an unauth RCE, update right away!
โ 3 โ 6 โค 4
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
post-4
โญโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฎ
โ Mark #4 โ
โ bc7291552be7a58f โ
โฐโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฏ
โธ 9d ago
Yeah, so if people couldn't guess already that it's an unauthenticated RCE, it's
definitely official now. Probably goes without saying, but don't publish the exploit
m0nad - there may still be people who haven't seen this and had time to update.
I'm curious whether you figured it out yourself, or used an LLM on the git diffs to find
it?
โ 1 โ 0 โค 0
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
post-5
โญโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฎ
โ kc1awv #5 โ
โ a1d54c6b2cf5290b โ
โฐโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฏ
โธ 9d ago
"look at what I can do!"
โ 1 โ 2 โค 0
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
post-6
โญโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฎ
โ m0nad #6 โ
โ 3324ab182093441e โ
โฐโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฏ
โธ 9d ago
Mark wrote:
> Yeah, so if people couldn't guess already that it's an unauthenticated RCE,
it's definitely official now. Probably goes without saying, but don't publish
the exploit m0nad - there may still be people who haven't seen this and had time to
update.
>
> I'm curious whether you figured it out yourself, or used an LLM on the git diffs
to find it?
Not publishing until the full details are released.
The reason for posting was to alert people that is not that hard to do this. If I can do
it, adversaries can do it. But of it is not appreciated I will avoid warning people next
time.
And yes, open weights llms on the git history did the trick.
โ 1 โ 0 โค 0
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
post-7
โญโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฎ
โ Mark #7 โ
โ bc7291552be7a58f โ
โฐโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฏ
โธ 9d ago
Didn't mean to say it was not appreciated, I was just genuinely curious how you went
about it.
โ 3 โ 0 โค 1
โ INFO โ Identify to this node to post. How?
bottom