DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 63KFhw53023338
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 022E84AA51FC
To: "cygwin AT cygwin DOT com" <cygwin AT cygwin DOT com>
Subject: cygrunsrv CWE-428
Thread-Topic: cygrunsrv CWE-428
Thread-Index: AQHc0NVwtZ0CP3KicUCm6yjAzwYimw==
Date: Mon, 20 Apr 2026 15:42:51 +0000
Message-ID: <SJ1PR10MB6003B9ADBEC8F87C9AC49AC3F82F2@SJ1PR10MB6003.namprd10.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
msip_labels: 
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: SJ1PR10MB6003:EE_|LV3PR10MB7865:EE_
x-ms-office365-filtering-correlation-id: 660fedde-9a17-4de0-6349-08de9ef37b7c
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;
 ARA:13230040|366016|6049299003|376014|1800799024|4053099003|13003099007|38070700021|56012099003|18002099003|8096899003;
x-microsoft-antispam-message-info: SzpJMxkidRCNpQyQYalge9aiHvd0VKpiFtEVm3rEdUfDE0nyvbO9FpdXqMJlfjKlJKa+JpVcda5dUQKQ35BlFJaa8l9nceU0tO9w+oM9S93Nt277zOUpokPN+m1OxpKO8F4jRCTzWYYC+5LFQt7G5bB7TulpHpK05B5yRzZ3NYx4tW2abAI4VjMQWdzTLDxfmhvtNbhHnkRfr5sRNuhcDcTvc5SiAryzHzKtcUlEam9jmHPmaOHdcma+5rsGK8wWo7Y3rJPErppgbiruzYS8UnkC32Qr7tQYU0bMTh9usE2BntMgT6GS89s/G+hPFsQv7soMZLEzvirYg0CCRJw6uEto1wfShZwNu0byvFN5vBVBaEo4HW54EJ2TEdJr7j8I6812r0/ZQUKb1ZnV/xgitHKnswZOFpTBxX5R9Gf1lBXrKwWPIDRiYox50PCN5KOZrqNumXHJv3tYjUxPGwDqOCU2pRWGqUkZ0eSnFRMLRzRJsm9D9jKmk2oitKax0OZgywbFSLazv3KoKlUZ1fTzKqsxthhbfpgWXzx2rVWAKyGDi+l1P/iRtjLu2j6mvnJQL13gDQ1RthTVA3cKj0jk/1fs77M3hqZgtnMQU+mOCq6AiU1H7gWYx0cX9zIGL4/XT/wbdAYYAZPrTwAenIuspByALKs1XjqvDaN6X/QYYgystIbyAdyAewU6ne6D8WE0F6nWO//VYNKG3OkFdtgaBqmOV7iQiAymGHBgySskAlx56liKQ7HVYDOiyhog2TiBb9ntB1Ty17gAa1hun1UJRKM+508A+Nqi42VX8rObSk4=
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:;
 IPV:NLI; SFV:NSPM; H:SJ1PR10MB6003.namprd10.prod.outlook.com; PTR:; CAT:NONE;
 SFS:(13230040)(366016)(6049299003)(376014)(1800799024)(4053099003)(13003099007)(38070700021)(56012099003)(18002099003)(8096899003);
 DIR:OUT; SFP:1102; 
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?2mEVVD4tHaqAAGJ24ocvW3zEZ04lTauOLQA0heWX/GbeQFarXgrwdDzvRY?=
 =?iso-8859-1?Q?YEHxykzqtJ7NhQVFThMF72rkY/35qtRZjrwMDkaPHiRjKQqHBBU8Nq33uh?=
 =?iso-8859-1?Q?R883UjRW22if1BfXO85ye9+RvFI8B/GKDFfd+abZt/qbOa0n4KK1dLFdLM?=
 =?iso-8859-1?Q?24c8HtB/VrajxYZKBFTQRcGlmMFJgm+2kiDehl23PVYlYsgEfdDISr5JvT?=
 =?iso-8859-1?Q?YTyl7o15jIFmva8NiukaPRBSqhfKwiqBog2TDCzKuVddQijX3TSRv5Uhs6?=
 =?iso-8859-1?Q?znhfDz/CN+ycT8SrMyXZoivewnm96ql723er8jNzsrfL+hqgzwV1BDvpsj?=
 =?iso-8859-1?Q?ZnfWknWCOl7W4IcEI7fLi6zwr9o2aSXdtmLeMK92GBGMji+qTgHZp5pY/d?=
 =?iso-8859-1?Q?ex/Pzk2SN7vuZnlcZsTJCWOzz+meyEKUSudEonBahwKJl/MatsacTO/Mm4?=
 =?iso-8859-1?Q?NL9cMZdN31w5g6e17GWE+FKMn9t0mMf9Y1PmpnF6Jv5ej0wCytZbyApVyZ?=
 =?iso-8859-1?Q?z8mF3pvE8aVCb9qhy1DOBWpT4xYBX7TvcIc90ByrTAF5XGMUl9FMazsXZ6?=
 =?iso-8859-1?Q?mO+yqd11Z98crldR7sYPHNZvk78uTe9qQlBT16ovtfPMhXJssIrxFpeLP4?=
 =?iso-8859-1?Q?Txm6NWXH5nxi1kMAxt2zC5AIFamoj7ta6c1IX129V6duN5m11iyU38dRo2?=
 =?iso-8859-1?Q?wMwa9j682QxYMogYamIG7kOaTuUbUIwxn011lD7jAb0lkKYPHOhgHS/dy8?=
 =?iso-8859-1?Q?M9N2Ev8jtlMibem227d9SEQDGTlEprKNmAl8J0bEhZy0s6jI4eEwFZEj0/?=
 =?iso-8859-1?Q?/rJZPaKgaHM+KxooKYRwJVsUfYBzJJ1saUc+gCfvdimoywDpIYjTbB2hVo?=
 =?iso-8859-1?Q?MMBooNgr2qS6LeOYGD55GH+mm/3pr9ucTtPdB/bIkpDukxS7ueAKET/iFD?=
 =?iso-8859-1?Q?82hnHQlpVvkqNKnrQbymy6mXm9VQE3+JFAutZC2Qia5bljqBmf5mnyYUZk?=
 =?iso-8859-1?Q?kB56AfgeXMhyok8V0bjldJdZKSW4hQ+EtbNNAlVpL9u6kgbjdh1z8FB7Z7?=
 =?iso-8859-1?Q?1aMUii5CxzmuXMybkHOqzusl/NGUQ0TcRf5z4A40/wjTgwuHDyKMGD0D1d?=
 =?iso-8859-1?Q?5D1XV7ympIA2w8WTa5NMhFj526ksYpwIX7BXXHpVCBhmkAPgCxK893XzSp?=
 =?iso-8859-1?Q?usBLa9WYlGGv2plxYDLzpanHZaaDnjuyEzLVSmMjd2UJLqjcGu8COemhWg?=
 =?iso-8859-1?Q?MFrBxR2B3NFC6GdHVeBQFo75jgUzO/gGgNiS2ATeKegbnpKaPPlneNwiBa?=
 =?iso-8859-1?Q?TjMEohUuKH5BB8fqBVslPyHn3Bcl059xdPr6yJ61iJf4ZpfMdZ1fN8Wngn?=
 =?iso-8859-1?Q?Ia9SLAVQu1MuNZoXTwSDFfUm5RYZqy6R/27VUj9ldNuCkWDIWMTqbiIJfU?=
 =?iso-8859-1?Q?Bf4oI4zgGRzflF7tn6WS9qj8ZfZ7qlRJ4oE4/m3D7nr+QDJPGAq37uymyc?=
 =?iso-8859-1?Q?VKiPNjaX5WS7nTDi3Zz4pyjPj4vvF21uDffTq3NTJA43dtnr6/PlMw7S27?=
 =?iso-8859-1?Q?jjYyAF2MSFZwsbaYZv5Lo3UpxAVUo+8kl5MTTwcR1eYLKtU99dz9GV8NA8?=
 =?iso-8859-1?Q?nYRtVGzRxkT/HxZvjTLm5hljQiB0C7SBsGZJfzRs7ZdVK/LJuDD4Z2IK3i?=
 =?iso-8859-1?Q?nVWSJ978JW8xwbyB3c3eu7mtPkBFukHDjuqKjsR2kxF6asj4d07+PBE9/j?=
 =?iso-8859-1?Q?iwtPjvTa+rNvb9b0YGOSn9Anb4IDVraRfAI/G1S4jldmxLwyqKTn+nNmve?=
 =?iso-8859-1?Q?CHKsWxdRJw=3D=3D?=
Content-Type: multipart/mixed;
 boundary="_004_SJ1PR10MB6003B9ADBEC8F87C9AC49AC3F82F2SJ1PR10MB6003namp_"
MIME-Version: 1.0
X-OriginatorOrg: rackwareinc.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SJ1PR10MB6003.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 660fedde-9a17-4de0-6349-08de9ef37b7c
X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Apr 2026 15:42:51.8653 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: acce4151-9118-4e3b-8141-9a6210dbb561
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: BsQqCEMDNyXXeluiHPkxnrfjxFX4DjtDI+dpJYL7AXbstteG3DcP24NvRTkfkTTAwMo+kw7Dmb3VO3SZ8DU6D/G6AfWSf8qFTCDdgA6/SD0=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV3PR10MB7865
X-Content-Filtered-By: Mailman/MimeDel 2.1.30
X-BeenThere: cygwin AT cygwin DOT com
X-Mailman-Version: 2.1.30
List-Id: General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Archive: <https://cygwin.com/pipermail/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe: <https://cygwin.com/mailman/listinfo/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
From: James Warnock via Cygwin <cygwin AT cygwin DOT com>
Reply-To: James Warnock <james DOT warnock AT rackwareinc DOT com>
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com>

--_004_SJ1PR10MB6003B9ADBEC8F87C9AC49AC3F82F2SJ1PR10MB6003namp_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

We use cygwin including installing some services via cygrunsrv. We have had=
 some users run vulnerability scans which flag the installed services due t=
o an unquoted service path (CWE-428 [1]). I haven't been able to find any d=
iscussion of this in the archives except for the "cygrunsrv -L outputs noth=
ing if service paths are quoted" [2]. In that message, another user manuall=
y added quotes to resolve the vulnerability scan but then 'cygrunsrv -L' no=
 longer listed installed services. That issue was fixed.

I did come up with a simple patch (attached) that worked for my limited use=
 case. But there may be considerations for global usage of which I am unawa=
re.

Should cygrunsrv be updated to automatically include the quotes?

Thanks,
James

[1] https://cwe.mitre.org/data/definitions/428.html
[2] https://cygwin.com/pipermail/cygwin/2023-February/252998.html

--_004_SJ1PR10MB6003B9ADBEC8F87C9AC49AC3F82F2SJ1PR10MB6003namp_
Content-Type: text/x-patch; name="cwe-428.patch"
Content-Description: cwe-428.patch
Content-Disposition: attachment; filename="cwe-428.patch"; size=1951;
	creation-date="Mon, 20 Apr 2026 15:23:41 GMT";
	modification-date="Mon, 20 Apr 2026 15:23:55 GMT"
Content-Transfer-Encoding: base64

ZGlmZiAtLWdpdCBhL2N5Z3J1bnNydi5jYyBiL2N5Z3J1bnNydi5jYwppbmRleCBkYWI4NzkwLi5j
M2IwNGVlIDEwMDY0NAotLS0gYS9jeWdydW5zcnYuY2MKKysrIGIvY3lncnVuc3J2LmNjCkBAIC04
MTAsNiArODEwLDcgQEAgaW5zdGFsbF9zZXJ2aWNlIChjb25zdCBjaGFyICpuYW1lLCBjb25zdCBj
aGFyICpjcnNwYXRoLCBjb25zdCBjaGFyICpkaXNwLAogCQkgaW50IGludGVyYWN0aXZlKQogewog
ICBjaGFyIG15cGF0aFtNQVhfUEFUSF07CisgIGNoYXIqIG15cGF0aF9wID0gbXlwYXRoOwogICBT
Q19IQU5ETEUgc20gPSAoU0NfSEFORExFKSAwOwogICBTQ19IQU5ETEUgc2ggPSAoU0NfSEFORExF
KSAwOwogICBjaGFyIHVzZXJidWZbSU5URVJORVRfTUFYX0hPU1RfTkFNRV9MRU5HVEggKyBVTkxF
TiArIDJdOwpAQCAtODI0LDI4ICs4MjUsMzEgQEAgaW5zdGFsbF9zZXJ2aWNlIChjb25zdCBjaGFy
ICpuYW1lLCBjb25zdCBjaGFyICpjcnNwYXRoLCBjb25zdCBjaGFyICpkaXNwLAogICBpZiAoIXNh
bi5zZXJ2ZXIgKCkpCiAgICAgY2hlY2tfc3lzdGVtX21vdW50cyAoKTsKIAorICBteXBhdGhbMF0g
PSAnIic7CisgIG15cGF0aF9wKys7CiAgIGlmIChjcnNwYXRoKQkJICAvKiBHb3QgcGF0aCwgbm90
aGluZyB0byBkby4gKi8KICAgICB7Ci0gICAgICBjeWd3aW5fY29udl9wYXRoIChDQ1BfUE9TSVhf
VE9fV0lOX0EsIGNyc3BhdGgsIG15cGF0aCwgTUFYX1BBVEgpOworICAgICAgY3lnd2luX2NvbnZf
cGF0aCAoQ0NQX1BPU0lYX1RPX1dJTl9BLCBjcnNwYXRoLCBteXBhdGhfcCwgTUFYX1BBVEgtMik7
CiAgICAgICBpZiAoc3RyY2FzZWNtcCAobXlwYXRoICsgc3RybGVuIChteXBhdGgpIC0gNCwgIi5l
eGUiKSAhPSAwKQogICAgICAgICBzdHJjYXQgKG15cGF0aCwgIi5leGUiKTsKICAgICB9CiAgIGVs
c2UgaWYgKHNhbi5zZXJ2ZXIgKCkpIC8qIEZpZ3VyZSBvdXQgY3lncnVuc3J2IHBhdGggb24gcmVt
b3RlIHNlcnZlci4gKi8KICAgICB7Ci0gICAgICBEV09SRCByZXQsIHR5cGUsIHNpemUgPSBNQVhf
UEFUSCAtIDIwOworICAgICAgRFdPUkQgcmV0LCB0eXBlLCBzaXplID0gTUFYX1BBVEggLSAyMjsK
ICAgICAgIGlmICgocmV0ID0gUmVnT3BlbktleUV4IChzYW4uaGtsbSAoKSwgKFBDSEFSKSBDWUdf
Uk9PVCwgMCwKIAkJCSAgICAgICBLRVlfUkVBRCwgJmN5Z19yb290X2tleSkpICE9IEVSUk9SX1NV
Q0NFU1MpCiAJZXJyX291dF9zZXRfZXJyb3IgKFJlZ09wZW5LZXlFeCwgcmV0KTsKICAgICAgIGlm
ICgocmV0ID0gUmVnUXVlcnlWYWx1ZUV4IChjeWdfcm9vdF9rZXksIChQQ0hBUikgQ1lHX1JPT1Rf
VkFMLCAwLCAmdHlwZSwKLQkJCQkgIChCWVRFICopIG15cGF0aCwgJnNpemUpKSAhPSBFUlJPUl9T
VUNDRVNTKQorCQkJCSAgKEJZVEUgKikgbXlwYXRoX3AsICZzaXplKSkgIT0gRVJST1JfU1VDQ0VT
UykKIAllcnJfb3V0X3NldF9lcnJvciAoUmVnUXVlcnlWYWx1ZUV4LCByZXQpOwotICAgICAgc3Ry
Y2F0IChteXBhdGgsICJcXGJpblxcY3lncnVuc3J2LmV4ZSIpOworICAgICAgc3RyY2F0IChteXBh
dGhfcCwgIlxcYmluXFxjeWdydW5zcnYuZXhlIik7CiAgICAgfQogICBlbHNlCQkJICAvKiBHZXQg
b3duIGZ1bGwgcGF0aC4gKi8KICAgICB7Ci0gICAgICBpZiAoIUdldE1vZHVsZUZpbGVOYW1lIChO
VUxMLCBteXBhdGgsIE1BWF9QQVRIKSkKKyAgICAgIGlmICghR2V0TW9kdWxlRmlsZU5hbWUgKE5V
TEwsIG15cGF0aF9wLCBNQVhfUEFUSC0yKSkKIAllcnJfb3V0IChHZXRNb2R1bGVGaWxlTmFtZSk7
CiAgICAgfQorICBzdHJjYXQgKG15cGF0aF9wLCAiXCIiKTsKICAgLyogT3BlbiBzZXJ2aWNlIG1h
bmFnZXIgZGF0YWJhc2UuICovCiAgIGlmICghKHNtID0gT3BlblNDTWFuYWdlciAoc2FuLnNlcnZl
ciAoKSwgTlVMTCwKIAkJCSAgICBTQ19NQU5BR0VSX0NPTk5FQ1QgfCBTQ19NQU5BR0VSX0NSRUFU
RV9TRVJWSUNFKSkpCg==

--_004_SJ1PR10MB6003B9ADBEC8F87C9AC49AC3F82F2SJ1PR10MB6003namp_
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple

--_004_SJ1PR10MB6003B9ADBEC8F87C9AC49AC3F82F2SJ1PR10MB6003namp_--