You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: weechat/doc/_i18n_security.py
+4Lines changed: 4 additions & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -14,6 +14,7 @@ def __i18n_doc_security():
14
14
gettext_noop("A buffer overflow happens when a new IRC message 005 is received with longer nick prefixes.\n<br>\nNote: a \"normal\" IRC server should not send again a message 005 with new nick prefixes, so the problem should be limited to malicious IRC servers.")
15
15
gettext_noop("A buffer overflow happens when decoding some IRC colors in strings.")
16
16
gettext_noop("A buffer overflows happens in build of strings in different places.")
17
+
gettext_noop("A crash happens when decoding a malformed HTTP message in relay plugin, protocol \"api\".\n<br>\nThis happens even if the client is not authenticated, the HTTP message is parsed before the authentication.")
17
18
gettext_noop("A crash happens when decoding a malformed websocket frame in relay plugin.\n<br>\nThis happens even if a password is set in relay plugin, the malformed websocket frame can be received before the authentication of the client.")
18
19
gettext_noop("A crash happens when receiving some WeeChat internal color codes in IRC messages.")
19
20
gettext_noop("API")
@@ -39,6 +40,7 @@ def __i18n_doc_security():
39
40
gettext_noop("Core, Plugins")
40
41
gettext_noop("Crash in API function infobar_printf.")
41
42
gettext_noop("Crash on IRC commands sent via Relay.")
43
+
gettext_noop("Crash on malformed HTTP message in relay plugin, protocol \"api\".")
42
44
gettext_noop("Crash on malformed IRC message 352 (WHO).")
43
45
gettext_noop("Crash on malformed websocket frame in relay plugin.")
44
46
gettext_noop("Crash on nicks monitored with /notify.")
@@ -60,6 +62,7 @@ def __i18n_doc_security():
60
62
gettext_noop("Integer overflow in loops on lists.")
61
63
gettext_noop("Integer overflow with decimal numbers in calculation of expression.")
62
64
gettext_noop("Logger")
65
+
gettext_noop("NULL Pointer Dereference")
63
66
gettext_noop("Out-of-bounds read")
64
67
gettext_noop("Out-of-bounds write")
65
68
gettext_noop("Possible man-in-the-middle attack in TLS connection to IRC server.")
@@ -72,6 +75,7 @@ def __i18n_doc_security():
72
75
gettext_noop("Strings are built with uncontrolled format when IRC commands are redirected by relay plugin. If the output or redirected command contains formatting chars like \"%\", this can lead to a crash of WeeChat.")
73
76
gettext_noop("Strings are built with uncontrolled format when nicks containing \"%\" are monitored with command <code>/notify</code>.")
74
77
gettext_noop("Strings are built with uncontrolled format when unknown IRC commands are sent to server, if option <code>irc.network.send_unknown_commands</code> is enabled.")
78
+
gettext_noop("There are multiple ways to mitigate this issue:\n<ul>\n <li>Rremove all relays with protocol \"api\", see: <code>/help relay</code></li>\n <li>Unload relay plugin with command: <code>/plugin unload relay</code> and see: <code>/help weechat.plugin.autoload</code></li>\n <li>Secure relay to allow only some trusted IP addresses, see: <code>/help relay.network.allowed_ips</code></li>\n</ul>")
75
79
gettext_noop("There are multiple ways to mitigate this issue:\n<ul>\n <li>Rremove all relays, see: <code>/help relay</code></li>\n <li>Unload relay plugin with command: <code>/plugin unload relay</code> and see: <code>/help weechat.plugin.autoload</code></li>\n <li>Secure relay to allow only some trusted IP addresses, see: <code>/help relay.network.allowed_ips</code></li>\n</ul>")
76
80
gettext_noop("There are multiple ways to mitigate this issue:\n<ul>\n <li>Turn off option to send unknown commands: <code>/set irc.network.send_unknown_commands off</code></li>\n <li>Do not use formatting chars like \"%\" when sending unknown commands to server.</li>\n</ul>")
77
81
gettext_noop("Turn of handling of colors in incoming IRC messages:\n\n<p><pre><code>/set irc.network.colors_receive off</code></pre></p>")
0 commit comments