Re: CVE-2018-3613 [was: MdeModulePkg Variable: Fix Timestamp zeroing issue on APPEND_WRITE]

[Laszlo Ersek <lersek@redhat.com>]

On 10/18/18 15:43, Zeng, Star wrote:
> Hi Laszlo,
> 
> On 2018/10/18 21:09, Laszlo Ersek wrote:
>> On a tangent:
>>
>> On 10/18/18 04:45, Zeng, Star wrote:
>>> On 2018/10/18 2:27, Laszlo Ersek wrote:
>>
>>>>>> http://mid.mail-archive.com/e62f7104-e341-6c7f-1af5-2130f161f111@redhat.com
>>>>>>
>>
>>>>> Sorry, I could not access it.
>>>>
>>>> I'm unsure if you mean that you didn't see that message when I posted
>>>> it, or else that you've now tried to follow the link, but it doesn't
>>>> work for you. Does the official edk2-devel archive work perhaps? Here's
>>>> a link within that, to the same message:
>>>>
>>>> https://lists.01.org/pipermail/edk2-devel/2018-August/028700.html
>>>
>>> The edk2-devel archive link works for me. But I did not review this
>>> thread and did not see the request. :(
>>
>> OK, understood.
>>
>>> FYI, I could not access the redhat archive link
>>> http://mid.mail-archive.com/e62f7104-e341-6c7f-1af5-2130f161f111@redhat.com,
>>>
>>> I just heard some other people also could not access it.
>>
>> That link isn't a "Red Hat" link. It is a link that points to
>>
>>    mid.mail-archive.com
>>
>> The site "mid.mail-archive.com" is a search service from
>> mail-archive.com. The URL is composed as follows:
>>
>>    mid.mail-archive.com + "/" + <Message-Id>
>>
>> In the <Message-Id> part, the user can place the message-id header of
>> the email that they are looking for.
>>
>> In the current case, the Message-Id of the email that I wanted to direct
>> you to was:
>>
>>    e62f7104-e341-6c7f-1af5-2130f161f111@redhat.com
>>
>> It ends with "@redhat.com" only because the message-id was originally
>> generated by a RH SMTP server (because the message was sent by me). So,
>> the complete link is not a "Red Hat" link; it is a mail-archive.com link
>> that happens to end with "@redhat.com" -- because the message ID that I
>> put in the URL, for the search service, ends with "@redhat.com".
> 
> I am not familiar with using mail-archive.com.
> I just did some check and found it is interesting that I could access
> https://www.mail-archive.com/edk2-devel@lists.01.org/msg43513.html, it
> is because it has "https"? Not sure.

That's a good point; I think it could very well be the reason.

Unfortunately, the message-id based search at mail-archive.com (that is,
the domain "mid.mail-archive.com") does *not* work with HTTPS. It is
regrettable, it has always annoyed me. I've tried the same URLs via the
HTTPS scheme in the past, and they've never worked. (They aren't working
right now either.) Otherwise I'd have posted HTTPS links on every occasion.

Thanks for raising this!
Laszlo