DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 63KKF2JH148203
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 37A184BA2E2F
To: "cygwin@cygwin.com" <cygwin@cygwin.com>
Subject: cygrunsrv CWE-428
Thread-Topic: cygrunsrv CWE-428
Thread-Index: AQHc0PUJa17M9Gtz+UWTrSNqrWmoow==
Date: Mon, 20 Apr 2026 20:13:59 +0000
Message-ID: <SJ1PR10MB6003BEF20B35247F4C6A13CEF82F2@SJ1PR10MB6003.namprd10.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
msip_labels: 
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: SJ1PR10MB6003:EE_|PH7PR10MB5721:EE_
x-ms-office365-filtering-correlation-id: c041b09e-b338-41e5-3588-08de9f195bdb
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;
 ARA:13230040|6049299003|1800799024|366016|376014|4053099003|38070700021|56012099003|18002099003;
x-microsoft-antispam-message-info: mzwHjtUmv8pwdRhc38H5XA4toBpa9DcR28p4uc3FVo14MsIhAC4Qzj7ph64hUEw+m8xja8UvskhWA2frSVzGEXRqwn3hCamYK9VrKNYPC2skXX5B23Bs2BUAqxVuDFbbwzjcUDzPTjyJkHDIVUF7OWG5DOd+7eNRy2dNe6GCzJSJJ4ZBuYZ4KuVNM0LCi8WfyAMlOVaTEY1BrVeKPtopOfclzZoJ1tDhcWlKGf6xbjyFbIGpKYpTg0400mgarO5+ToBcRDSv4UZTm+3HxNYYhtEWxL+RjMt2gYzZ5qPPrgXk3ZwKejDQdD2G+YnFCwF4mMVru8hY6hwhpOD4iPyB3yJsEmtbDEcCMHP2TjhTCg8BLPLhcMyFqzb5F4MTImMhl46L9VfBc2V7TktaAx1lO4K6YqdVFIVuFH0VrO8DSxwPxDDbKf+LD/DQcpKni9toV1mMhOvcZFvbvI5JVYvOTSqknE5fy+ADuCsNRGJ4+lRG8aiFqns76piSp7OR2FVDVRi+bKm1abgqBGmwPeZkFJgAi26yjz4zm8xhlGP7mM/DSbIsrQeSyK6AKEWS9Tpxry3Z6wl8MJ+mvwYiUygATlplAYP4ji4asES01vfr4huQaU1WWP8S9pZyGg0bJD3B+uvwKTCKq68n34kgzm5yckyBmKaw9it9EWDD82m9KKWvcK5t+MF0o3SAsETlf+BvxNkeo852hiAbo3RW5pUFz9f5xRiH9IMToHpypmscZCUIqYHxbh7STzHmEoE5Rvgd1x4eWyhMX3/VxMNVraYPikNp6MmDVh4EKo1wpKOLYVA=
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:;
 IPV:NLI; SFV:NSPM; H:SJ1PR10MB6003.namprd10.prod.outlook.com; PTR:; CAT:NONE;
 SFS:(13230040)(6049299003)(1800799024)(366016)(376014)(4053099003)(38070700021)(56012099003)(18002099003);
 DIR:OUT; SFP:1102; 
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?vXkeEvlw794J3GMcbcNoD3EtW754scTALPaBX9LDTFtaGbKj914/VrIOtw?=
 =?iso-8859-1?Q?RJyH8zBQtcudpQ/KeXRHyHr1YbtwluC38ZWUJPfAo1vrIVOihz3gZg7+do?=
 =?iso-8859-1?Q?T97OJ/nhZBAiLk7G1zwxuTdbh+GKQaAeLP7nzqM0ilq+kTWa/mjRmo5y9N?=
 =?iso-8859-1?Q?7rYXBJT0wBCDNpIU8T9yVJg150PCLpSkxeNKjL1YRVfjNz64zzYy+FqfqA?=
 =?iso-8859-1?Q?1YLtmymlX+tDkaTJAE9Ff+S9OQQE4x9HdlI/0CvCCpSzuvWB+Mvyv/TsTt?=
 =?iso-8859-1?Q?ttRrcWRlnQAJVsXN1dr9CWdulSONTmBl015qv61yHEB58XO3SoeGuetw7C?=
 =?iso-8859-1?Q?36R2EKrA45OCDAQogRaXje0/WqWAX9/p6GyzxWhXslpORPpyjpVm0IVXtM?=
 =?iso-8859-1?Q?1Cuhvmh8NqkWYi5zzOmjDL0nq5FZKPCjNefKFV6mqzB3Xwrbuz1Njk8bE8?=
 =?iso-8859-1?Q?Cg025V06Jr0HJtosdIbI59Ebh6AQ3bZxyU0Nbp0SCREF8jcuWaQUZGfKst?=
 =?iso-8859-1?Q?8nZOyNj55J5/suT1ESqgVzcOaynidAoyP6u1w9OIZ+ddIMrde3xKvwbGZ/?=
 =?iso-8859-1?Q?WzT7T7m4onJ5UIxnOKcpxrNqcCaSN77YNbINKFhzf7tNNJfHwDNGXDH1Ew?=
 =?iso-8859-1?Q?hF+uqpVc5RLUP/xbHnMsBO9AI5aKOZCNxJ6VXWNMyzHLDvVS/hXrBPv7Z2?=
 =?iso-8859-1?Q?a/8XjsGG8YXmProp5L7cVHzfPlXkuLI6NzAAAwcjz8ly3BQjlgW+Ywxq6+?=
 =?iso-8859-1?Q?WNPfdQrwsZxi8ucBrML3RWBbER8/tcBiSvCMJp/R0SDDH/Rhqq5mX7F4o4?=
 =?iso-8859-1?Q?UHw1uafeaLMlUq/QIHdlnNknJd9eyYEN0u8D5j5Vx8vcG6zV+1YvwCQDLR?=
 =?iso-8859-1?Q?q3W+t66QfZ2jWEOsIl7eigZ1H1wg92BiZdqofIn//aNjuPw83amsv0yDOl?=
 =?iso-8859-1?Q?KmgJJhxXI6zDLMtg/sJXd/fztJJeoZou6WqV+1KSGhEf4otp3EUbSTRPcd?=
 =?iso-8859-1?Q?WZpElb9j6wXS//s1Fdz5lVbpzSofSZPqv7sQerkgjS+iAxpsM87uPZv6pV?=
 =?iso-8859-1?Q?SljcuUEYJvzNStftmrdD6wTV5Djq9ObIxgmlHzHszDammMIOKYqXn4vMoX?=
 =?iso-8859-1?Q?t3n95/0+h4r3Gh2POB23ryWqSpB+nbrA2LxNqY5E0HNnQAVsEcfFOx/SJW?=
 =?iso-8859-1?Q?qMp9mrCiLahYSGjQvpE8884KhHOSRLAMnZmEtBBiu29y6Z99kjzFCROMOK?=
 =?iso-8859-1?Q?nXsiUvN2Y/C1YVLZU8p2CxjnUbWuZy304CW1+qJmr70zjxPwiFit7+61lL?=
 =?iso-8859-1?Q?ddj62AKMAhSrVRVA/vjRJFqBFAjNW1xyCo0eIyJKEIMQnrQRdGxl4NUJ3w?=
 =?iso-8859-1?Q?Jwy5pBFTHOICtD9ncM5n+IQJgM6HuWNZqQ0UVfPb17Bb+AOiqZ+lsrGBVm?=
 =?iso-8859-1?Q?2rEO5t8oYhwmP8NMavjCr0/m6F5spiUprKkvYPO83Pa+xkW8ddc78cUxPq?=
 =?iso-8859-1?Q?OlCqFg6bn7aB47PqM+3hEic1UFbKmA2wYctvlD7qk1fLBiWcE6yaYrVwt0?=
 =?iso-8859-1?Q?GP4aeclWu9260AOqnzewGuJeGLsFJSDf09HCjBKwjKoa4w2psrghHxVtNs?=
 =?iso-8859-1?Q?Lv8YzqdTLuTqYdPfdsorqttw0FunalDzc4abom3S1T8kizyOH2z/0mM4OD?=
 =?iso-8859-1?Q?3CGj/3kyJuFV8idWbddw6Jj9/bT+y5AZMneRamScA/9MrDENXG4lPpFURG?=
 =?iso-8859-1?Q?nuKVYcvfp9PDxzJbwyT3BRoXndLaT3/D7EXo6GIJB1iNikC8RI+psTQLPa?=
 =?iso-8859-1?Q?SN/6k+aXRQ=3D=3D?=
Content-Type: multipart/mixed;
 boundary="_002_SJ1PR10MB6003BEF20B35247F4C6A13CEF82F2SJ1PR10MB6003namp_"
MIME-Version: 1.0
X-OriginatorOrg: rackwareinc.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SJ1PR10MB6003.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c041b09e-b338-41e5-3588-08de9f195bdb
X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Apr 2026 20:13:59.6982 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: acce4151-9118-4e3b-8141-9a6210dbb561
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 2W1R7EmliVUJYtSJtxXIY7KQVFxC+nwHdlbEzZYLpBXrtF6pnBFQ7hjUj1kP58H4tfyYTMkhZ/2pHadh9i6aJUEjGxd0ZEf4Bqfrj/TO5gY=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR10MB5721
X-BeenThere: cygwin@cygwin.com
X-Mailman-Version: 2.1.30
List-Id: General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Archive: <https://cygwin.com/pipermail/cygwin/>
List-Post: <mailto:cygwin@cygwin.com>
List-Help: <mailto:cygwin-request@cygwin.com?subject=help>
List-Subscribe: <https://cygwin.com/mailman/listinfo/cygwin>,
 <mailto:cygwin-request@cygwin.com?subject=subscribe>
From: James Warnock via Cygwin <cygwin@cygwin.com>
Reply-To: James Warnock <james.warnock@rackwareinc.com>
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie.com@cygwin.com>

--_002_SJ1PR10MB6003BEF20B35247F4C6A13CEF82F2SJ1PR10MB6003namp_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

We use cygwin including installing some services via cygrunsrv. We have had=
 some users run vulnerability scans which flag the installed services due t=
o an unquoted service path (CWE-428 [1]). I haven't been able to find any d=
iscussion of this in the archives except for the "cygrunsrv -L outputs noth=
ing if service paths are quoted" [2]. In that message, another user manuall=
y added quotes to resolve the vulnerability scan but then 'cygrunsrv -L' no=
 longer listed installed services. That issue was fixed.=0A=
=0A=
I did come up with a simple patch (attached) that worked for my limited use=
 case. But there may be considerations for global usage of which I am unawa=
re.=0A=
=0A=
Should cygrunsrv be updated to automatically include the quotes?=0A=
=0A=
Thanks,=0A=
James=0A=
=0A=
[1] https://cwe.mitre.org/data/definitions/428.html=0A=
[2] https://cygwin.com/pipermail/cygwin/2023-February/252998.html=

--_002_SJ1PR10MB6003BEF20B35247F4C6A13CEF82F2SJ1PR10MB6003namp_
Content-Type: text/x-patch; name="cwe-428.patch"
Content-Description: cwe-428.patch
Content-Disposition: attachment; filename="cwe-428.patch"; size=1951;
	creation-date="Mon, 20 Apr 2026 19:19:35 GMT";
	modification-date="Mon, 20 Apr 2026 19:19:35 GMT"
Content-Transfer-Encoding: base64

ZGlmZiAtLWdpdCBhL2N5Z3J1bnNydi5jYyBiL2N5Z3J1bnNydi5jYwppbmRleCBkYWI4NzkwLi5j
M2IwNGVlIDEwMDY0NAotLS0gYS9jeWdydW5zcnYuY2MKKysrIGIvY3lncnVuc3J2LmNjCkBAIC04
MTAsNiArODEwLDcgQEAgaW5zdGFsbF9zZXJ2aWNlIChjb25zdCBjaGFyICpuYW1lLCBjb25zdCBj
aGFyICpjcnNwYXRoLCBjb25zdCBjaGFyICpkaXNwLAogCQkgaW50IGludGVyYWN0aXZlKQogewog
ICBjaGFyIG15cGF0aFtNQVhfUEFUSF07CisgIGNoYXIqIG15cGF0aF9wID0gbXlwYXRoOwogICBT
Q19IQU5ETEUgc20gPSAoU0NfSEFORExFKSAwOwogICBTQ19IQU5ETEUgc2ggPSAoU0NfSEFORExF
KSAwOwogICBjaGFyIHVzZXJidWZbSU5URVJORVRfTUFYX0hPU1RfTkFNRV9MRU5HVEggKyBVTkxF
TiArIDJdOwpAQCAtODI0LDI4ICs4MjUsMzEgQEAgaW5zdGFsbF9zZXJ2aWNlIChjb25zdCBjaGFy
ICpuYW1lLCBjb25zdCBjaGFyICpjcnNwYXRoLCBjb25zdCBjaGFyICpkaXNwLAogICBpZiAoIXNh
bi5zZXJ2ZXIgKCkpCiAgICAgY2hlY2tfc3lzdGVtX21vdW50cyAoKTsKIAorICBteXBhdGhbMF0g
PSAnIic7CisgIG15cGF0aF9wKys7CiAgIGlmIChjcnNwYXRoKQkJICAvKiBHb3QgcGF0aCwgbm90
aGluZyB0byBkby4gKi8KICAgICB7Ci0gICAgICBjeWd3aW5fY29udl9wYXRoIChDQ1BfUE9TSVhf
VE9fV0lOX0EsIGNyc3BhdGgsIG15cGF0aCwgTUFYX1BBVEgpOworICAgICAgY3lnd2luX2NvbnZf
cGF0aCAoQ0NQX1BPU0lYX1RPX1dJTl9BLCBjcnNwYXRoLCBteXBhdGhfcCwgTUFYX1BBVEgtMik7
CiAgICAgICBpZiAoc3RyY2FzZWNtcCAobXlwYXRoICsgc3RybGVuIChteXBhdGgpIC0gNCwgIi5l
eGUiKSAhPSAwKQogICAgICAgICBzdHJjYXQgKG15cGF0aCwgIi5leGUiKTsKICAgICB9CiAgIGVs
c2UgaWYgKHNhbi5zZXJ2ZXIgKCkpIC8qIEZpZ3VyZSBvdXQgY3lncnVuc3J2IHBhdGggb24gcmVt
b3RlIHNlcnZlci4gKi8KICAgICB7Ci0gICAgICBEV09SRCByZXQsIHR5cGUsIHNpemUgPSBNQVhf
UEFUSCAtIDIwOworICAgICAgRFdPUkQgcmV0LCB0eXBlLCBzaXplID0gTUFYX1BBVEggLSAyMjsK
ICAgICAgIGlmICgocmV0ID0gUmVnT3BlbktleUV4IChzYW4uaGtsbSAoKSwgKFBDSEFSKSBDWUdf
Uk9PVCwgMCwKIAkJCSAgICAgICBLRVlfUkVBRCwgJmN5Z19yb290X2tleSkpICE9IEVSUk9SX1NV
Q0NFU1MpCiAJZXJyX291dF9zZXRfZXJyb3IgKFJlZ09wZW5LZXlFeCwgcmV0KTsKICAgICAgIGlm
ICgocmV0ID0gUmVnUXVlcnlWYWx1ZUV4IChjeWdfcm9vdF9rZXksIChQQ0hBUikgQ1lHX1JPT1Rf
VkFMLCAwLCAmdHlwZSwKLQkJCQkgIChCWVRFICopIG15cGF0aCwgJnNpemUpKSAhPSBFUlJPUl9T
VUNDRVNTKQorCQkJCSAgKEJZVEUgKikgbXlwYXRoX3AsICZzaXplKSkgIT0gRVJST1JfU1VDQ0VT
UykKIAllcnJfb3V0X3NldF9lcnJvciAoUmVnUXVlcnlWYWx1ZUV4LCByZXQpOwotICAgICAgc3Ry
Y2F0IChteXBhdGgsICJcXGJpblxcY3lncnVuc3J2LmV4ZSIpOworICAgICAgc3RyY2F0IChteXBh
dGhfcCwgIlxcYmluXFxjeWdydW5zcnYuZXhlIik7CiAgICAgfQogICBlbHNlCQkJICAvKiBHZXQg
b3duIGZ1bGwgcGF0aC4gKi8KICAgICB7Ci0gICAgICBpZiAoIUdldE1vZHVsZUZpbGVOYW1lIChO
VUxMLCBteXBhdGgsIE1BWF9QQVRIKSkKKyAgICAgIGlmICghR2V0TW9kdWxlRmlsZU5hbWUgKE5V
TEwsIG15cGF0aF9wLCBNQVhfUEFUSC0yKSkKIAllcnJfb3V0IChHZXRNb2R1bGVGaWxlTmFtZSk7
CiAgICAgfQorICBzdHJjYXQgKG15cGF0aF9wLCAiXCIiKTsKICAgLyogT3BlbiBzZXJ2aWNlIG1h
bmFnZXIgZGF0YWJhc2UuICovCiAgIGlmICghKHNtID0gT3BlblNDTWFuYWdlciAoc2FuLnNlcnZl
ciAoKSwgTlVMTCwKIAkJCSAgICBTQ19NQU5BR0VSX0NPTk5FQ1QgfCBTQ19NQU5BR0VSX0NSRUFU
RV9TRVJWSUNFKSkpCg==

--_002_SJ1PR10MB6003BEF20B35247F4C6A13CEF82F2SJ1PR10MB6003namp_
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple

--_002_SJ1PR10MB6003BEF20B35247F4C6A13CEF82F2SJ1PR10MB6003namp_--