russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

1.6 KiB

Raw Permalink Blame History

Sendmail — CWE-312 Disclosure Brief (sendmail-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

A cleartext credential logging defect in getauth() at sendmail/usersmtp.c:998. SASL authentication credentials (including passwords) log verbatim via sm_syslog() at debug level 95/5. Any system with trace-level SASL debugging enabled exposes plaintext passwords in syslog output.

The Defect

sendmail-0001 (PATCHED — HIGH): sendmail/usersmtp.c:998

if (tTd(95, 5))
    sm_syslog(LOG_DEBUG, NOQID, "getauth %s=%s",
              sasl_info_name[r], (*sai)[r]);
// Logs SASL_PASSWORD field verbatim when r == SASL_PASSWORD

Impact

Sendmail handles email delivery for organizations worldwide. When SASL debug tracing (level 95, detail 5) activates, SMTP authentication passwords appear in plaintext in system logs. These logs may persist on disk, replicate to centralized logging systems, or become visible to operators without mail-admin privileges.

The Fix

Redact the password field when logging SASL authentication info:

sm_syslog(LOG_DEBUG, NOQID, "getauth %s=%s",
          sasl_info_name[r],
          (r == SASL_PASSWORD) ? "<REDACTED>" : (*sai)[r]);

Patch

Fix available: defects/sendmail-0001/patch/sendmail-0001.patch

What We Ask

Confirm receipt and assign a tracking reference.
Assess severity — SASL passwords log in plaintext when debug tracing activates.
Coordinate a disclosure date — targeting 90 days from first contact.
We will credit the Sendmail team in the public disclosure.

Contact: see cover email. This brief is confidential until coordinated disclosure.

1.6 KiB Raw Permalink Blame History