DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 63LEx5rD1432680
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 2D3954BA23D9
Content-Type: multipart/mixed; boundary="------------KWqEOL5Ou9C8l1bbh1vtwN3o"
Message-ID: <ee2370b2-34d7-4501-8a4c-49f0b1abd13f@rackwareinc.com>
Date: Tue, 21 Apr 2026 08:57:31 -0600
User-Agent: Mozilla Thunderbird
Content-Language: en-US
To: cygwin AT cygwin DOT com
Subject: cygrunsrv CWE-428
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?UzFJbFM2M0hNUVMyVmxMSnp4Tmh2TnlMcGFrS09FUmlwK3hYZ2hjcUV0OW02?=
 =?utf-8?B?WWFPTWluMDVZZlZBRExMbDhrNXVZTWxrMUVhbFgxcS8yRDh1RFdtT2xJSnFC?=
 =?utf-8?B?cFo3N3h5YzFOSWVZc1pDZ2pFV3B3NmFBUTZSL2JIYVZKalBvN3k2RkwrWDFM?=
 =?utf-8?B?dE81WkZwdFcxSmZwVzBLMmp3K205L0xOMWhRaHFPQkFiZEdVYm5aL0NtbHF1?=
 =?utf-8?B?SXdSclIxOUFibXB1TmY2TVNVTXRXczBueS80M2U2Y2I5RUVwQU81TjRXY3ZE?=
 =?utf-8?B?eWdXSFBLNFllNHFwZWtCL3ZycytPOFZ4Sjd5L25sSHRyM2hjWTlKODNoVjF3?=
 =?utf-8?B?MHZTS2EvQUl1TEpFbkFRYmRWNExnK0tRU3B4OTZ3MkF3c0RZT0ZRZ0RUMDZY?=
 =?utf-8?B?VG5Mc1hPVVFBT2NLZ0FudzhBNmtlQXhYNVN5RGU0ako3Qjd2S0ZnNnQrdHJO?=
 =?utf-8?B?SGpNQVJOenEwSXhoWFQ4Rnc2UTRka2tKQUpmNUdabVZYbTdGeEZlQVdkcFJP?=
 =?utf-8?B?UG4zcitmSGN6dzlnRXJBYlA3Q2oyT1FULzJUaVVNSjJiYmhPMG5xTlJ5aTVP?=
 =?utf-8?B?NVo2L2hkamhjYmZ5M2xYZUlDK05yMm5lU2wzbFVJelJHYW92NG5TNEgySGJ4?=
 =?utf-8?B?bUtCUUR1MEZ2WW5tK1RZL3pJN01oTGhGb1RsSHBraG1lYVpYY1JoYkM3Q1c3?=
 =?utf-8?B?T0R0aGJzbExMWGJPRFg3VDlrYUU4eEtxelRRNGRNTFcrRXZZSkh5dHRQZjVa?=
 =?utf-8?B?NDROajNsWVE1VzdSUGI3RzcreG80RmY4SXF6SzNHNi8rOTVLM0NZZDlmNnhW?=
 =?utf-8?B?QzBzSDhJWittRkZ5TDlrTE1aSVNwTldPcjlqL2dWY2dod0liRFNUTjdCY0sw?=
 =?utf-8?B?MlU2NnRQSlZDRFhOV3M4RkxyMFlMczhQdzZwb1lYT0x4L0YzK2k3djRvODVB?=
 =?utf-8?B?Z3AxUURVU2F6eXBhTjhubUtTVDB6b3I2MlZmZDhrb0xQRmVLcGJ4eXE0WUkw?=
 =?utf-8?B?VkE3L0dyU1dyeS80UVc4TzBkbG41Vk44aFd2V2M3d0hLa2FKNEYwWXV3c1hn?=
 =?utf-8?B?THRDYWs4UEF2ZjZxTTNNL0huZmdSbGg0Wmc3UG8xUkJUdjdXeVl5NHJMT0hD?=
 =?utf-8?B?eTVEamZoMG0zVzZVeHNKckJYUXZvZHBBRjlhVEx1THNLRUhoR1VkUXNpSlhS?=
 =?utf-8?B?Qk41RWFNUUR4VmU1V0g4enl2TXBOSVc5LzQwbEQyVnMzRFBOZElvTllMTVp6?=
 =?utf-8?B?WEwxSXBxNVZldE9pUENiSXQwVVBXMUlUR0k4R0ZqdGp4dnRlaDRLVmMxdVpZ?=
 =?utf-8?B?ZEdqNCs0SWY4UTY1WXdyWjZ5NWdUN2FMdnd2OUNDTWZEMXJUNHV3TWQ0RjhX?=
 =?utf-8?B?cTViL1hnWlVNZmVpTTNSYm05c25TcHVDUlRSeVMyeTZXVTRiUFpLdjl4TTZG?=
 =?utf-8?B?SFU1R3l2RkRTUXpBWWF0UmU0bVZuUGJnTnBJcnVFU0lLRkR1ZFMyWEtMVGJK?=
 =?utf-8?B?UnAwNW1OblZQdXkrRWdtUlB0ZHM2by9RNXp2SWdJUDRaRyt5ZDRKUXVUcUNX?=
 =?utf-8?B?djZvcnhmSkV2cmlIeVIyRmZNT0F5M0toLyszZzVRLzZIUWplY0xrOS84RmFp?=
 =?utf-8?B?RHdDWE0xOTdWbEJhREd4SUw0N2dnMmFsZDVNUFJSbmx4V2luSndBR3ZZamxx?=
 =?utf-8?B?K1UzQVpvVWsvVnpCVzBkN3lUUVBCNFoxRHRnWUZpeklNT2pKQzNlSUxaa2Rz?=
 =?utf-8?B?Nk1hUmwyRlN1S1pTM3o2TWRqTGtOWHdOY3N0cHNLMXh4b2V5QzlCOUhjZG14?=
 =?utf-8?B?WE1lZkMwVXZKOTFnSU9KZGxmRVR3bzg3d1hsOWs2eEF6RnRxTGRSL1FXalRS?=
 =?utf-8?B?WGdoYzlFVTg1MG9CY3oyV09QeUJtOUFxYXZodXhTbUVDUU9qc2gyZmlldXdn?=
 =?utf-8?B?cDFJLzZmSjQ0cHQvZUpjL3RDcW11RU9GVk5aU0JlbjhRREpkTlhZZzJ2a0sz?=
 =?utf-8?B?b0F2SWdYUU9LSDQ0eVJaQU5FbDRnU2RkUm93TitFTkRGbWN4KzBwWlJ5QS8w?=
 =?utf-8?B?YTIrZnU3YzVSV1R0cUlFeU9HOG5GOGtuay9Ra2h1Z3ZySEl0bm1HZDR4MGJD?=
 =?utf-8?B?czk4TnVCc21oUGFic3lPdTBuRVM4UlB0d1hXVllBYUhzS3p3czJjT1Ard3N3?=
 =?utf-8?B?YkNGZ0k0em9GR2swaFMya2Rtb1FXa25tSXA3OTZMRTNmc295TlJyS1V2am54?=
 =?utf-8?B?V0VESWx0dk9ma0NaVFVqNTI3bkU1RHB0VjlZY0RxMVdHKytsLzJkRk5zamwz?=
 =?utf-8?B?ZmoyTitpdnBnZnZlYklUc2JaM3FOb2lWcHNSME9mc2hJM1Job0d2eFhpNkFD?=
 =?utf-8?Q?AabkBwCd87imqFb4=3D?=
X-OriginatorOrg: rackwareinc.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 90ef51b8-4672-450e-924e-08de9fb6515a
X-MS-Exchange-CrossTenant-AuthSource: SJ1PR10MB6003.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Apr 2026 14:57:33.7796 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: acce4151-9118-4e3b-8141-9a6210dbb561
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: Kt5KhIRVJZBuNnDsNvz1NnTJFXral4FBUFJNI39ftBmBzSIACnx6S/+7FBPppHheEbNGFiswDba9zWl9R1iWFwA6axpY5x8wy3VN5gRPJNU=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH3PPF8C8C3D129
X-BeenThere: cygwin AT cygwin DOT com
X-Mailman-Version: 2.1.30
List-Id: General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Archive: <https://cygwin.com/pipermail/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe: <https://cygwin.com/mailman/listinfo/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
From: James Warnock via Cygwin <cygwin AT cygwin DOT com>
Reply-To: James Warnock <james DOT warnock AT rackwareinc DOT com>
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com>

--------------KWqEOL5Ou9C8l1bbh1vtwN3o
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

We use cygwin including installing some services via cygrunsrv. We have 
had some users run vulnerability scans which flag the installed services 
due to an unquoted service path (CWE-428 [1]). I haven't been able to 
find any discussion of this in the archives except for the "cygrunsrv -L 
outputs nothing if service paths are quoted" [2]. In that message, 
another user manually added quotes to resolve the vulnerability scan but 
then 'cygrunsrv -L' no longer listed installed services. That issue was 
fixed.

I did come up with a simple patch (attached) that worked for my limited 
use case. But there may be considerations for global usage of which I am 
unaware.

Should cygrunsrv be updated to automatically include the quotes?

Thanks,
James

[1] https://cwe.mitre.org/data/definitions/428.html
[2] https://cygwin.com/pipermail/cygwin/2023-February/252998.html

--------------KWqEOL5Ou9C8l1bbh1vtwN3o
Content-Type: text/x-patch; charset=UTF-8; name="cwe-428.patch"
Content-Disposition: attachment; filename="cwe-428.patch"
Content-Transfer-Encoding: base64

ZGlmZiAtLWdpdCBhL2N5Z3J1bnNydi5jYyBiL2N5Z3J1bnNydi5jYwppbmRleCBkYWI4NzkwLi5j
M2IwNGVlIDEwMDY0NAotLS0gYS9jeWdydW5zcnYuY2MKKysrIGIvY3lncnVuc3J2LmNjCkBAIC04
MTAsNiArODEwLDcgQEAgaW5zdGFsbF9zZXJ2aWNlIChjb25zdCBjaGFyICpuYW1lLCBjb25zdCBj
aGFyICpjcnNwYXRoLCBjb25zdCBjaGFyICpkaXNwLAogCQkgaW50IGludGVyYWN0aXZlKQogewog
ICBjaGFyIG15cGF0aFtNQVhfUEFUSF07CisgIGNoYXIqIG15cGF0aF9wID0gbXlwYXRoOwogICBT
Q19IQU5ETEUgc20gPSAoU0NfSEFORExFKSAwOwogICBTQ19IQU5ETEUgc2ggPSAoU0NfSEFORExF
KSAwOwogICBjaGFyIHVzZXJidWZbSU5URVJORVRfTUFYX0hPU1RfTkFNRV9MRU5HVEggKyBVTkxF
TiArIDJdOwpAQCAtODI0LDI4ICs4MjUsMzEgQEAgaW5zdGFsbF9zZXJ2aWNlIChjb25zdCBjaGFy
ICpuYW1lLCBjb25zdCBjaGFyICpjcnNwYXRoLCBjb25zdCBjaGFyICpkaXNwLAogICBpZiAoIXNh
bi5zZXJ2ZXIgKCkpCiAgICAgY2hlY2tfc3lzdGVtX21vdW50cyAoKTsKIAorICBteXBhdGhbMF0g
PSAnIic7CisgIG15cGF0aF9wKys7CiAgIGlmIChjcnNwYXRoKQkJICAvKiBHb3QgcGF0aCwgbm90
aGluZyB0byBkby4gKi8KICAgICB7Ci0gICAgICBjeWd3aW5fY29udl9wYXRoIChDQ1BfUE9TSVhf
VE9fV0lOX0EsIGNyc3BhdGgsIG15cGF0aCwgTUFYX1BBVEgpOworICAgICAgY3lnd2luX2NvbnZf
cGF0aCAoQ0NQX1BPU0lYX1RPX1dJTl9BLCBjcnNwYXRoLCBteXBhdGhfcCwgTUFYX1BBVEgtMik7
CiAgICAgICBpZiAoc3RyY2FzZWNtcCAobXlwYXRoICsgc3RybGVuIChteXBhdGgpIC0gNCwgIi5l
eGUiKSAhPSAwKQogICAgICAgICBzdHJjYXQgKG15cGF0aCwgIi5leGUiKTsKICAgICB9CiAgIGVs
c2UgaWYgKHNhbi5zZXJ2ZXIgKCkpIC8qIEZpZ3VyZSBvdXQgY3lncnVuc3J2IHBhdGggb24gcmVt
b3RlIHNlcnZlci4gKi8KICAgICB7Ci0gICAgICBEV09SRCByZXQsIHR5cGUsIHNpemUgPSBNQVhf
UEFUSCAtIDIwOworICAgICAgRFdPUkQgcmV0LCB0eXBlLCBzaXplID0gTUFYX1BBVEggLSAyMjsK
ICAgICAgIGlmICgocmV0ID0gUmVnT3BlbktleUV4IChzYW4uaGtsbSAoKSwgKFBDSEFSKSBDWUdf
Uk9PVCwgMCwKIAkJCSAgICAgICBLRVlfUkVBRCwgJmN5Z19yb290X2tleSkpICE9IEVSUk9SX1NV
Q0NFU1MpCiAJZXJyX291dF9zZXRfZXJyb3IgKFJlZ09wZW5LZXlFeCwgcmV0KTsKICAgICAgIGlm
ICgocmV0ID0gUmVnUXVlcnlWYWx1ZUV4IChjeWdfcm9vdF9rZXksIChQQ0hBUikgQ1lHX1JPT1Rf
VkFMLCAwLCAmdHlwZSwKLQkJCQkgIChCWVRFICopIG15cGF0aCwgJnNpemUpKSAhPSBFUlJPUl9T
VUNDRVNTKQorCQkJCSAgKEJZVEUgKikgbXlwYXRoX3AsICZzaXplKSkgIT0gRVJST1JfU1VDQ0VT
UykKIAllcnJfb3V0X3NldF9lcnJvciAoUmVnUXVlcnlWYWx1ZUV4LCByZXQpOwotICAgICAgc3Ry
Y2F0IChteXBhdGgsICJcXGJpblxcY3lncnVuc3J2LmV4ZSIpOworICAgICAgc3RyY2F0IChteXBh
dGhfcCwgIlxcYmluXFxjeWdydW5zcnYuZXhlIik7CiAgICAgfQogICBlbHNlCQkJICAvKiBHZXQg
b3duIGZ1bGwgcGF0aC4gKi8KICAgICB7Ci0gICAgICBpZiAoIUdldE1vZHVsZUZpbGVOYW1lIChO
VUxMLCBteXBhdGgsIE1BWF9QQVRIKSkKKyAgICAgIGlmICghR2V0TW9kdWxlRmlsZU5hbWUgKE5V
TEwsIG15cGF0aF9wLCBNQVhfUEFUSC0yKSkKIAllcnJfb3V0IChHZXRNb2R1bGVGaWxlTmFtZSk7
CiAgICAgfQorICBzdHJjYXQgKG15cGF0aF9wLCAiXCIiKTsKICAgLyogT3BlbiBzZXJ2aWNlIG1h
bmFnZXIgZGF0YWJhc2UuICovCiAgIGlmICghKHNtID0gT3BlblNDTWFuYWdlciAoc2FuLnNlcnZl
ciAoKSwgTlVMTCwKIAkJCSAgICBTQ19NQU5BR0VSX0NPTk5FQ1QgfCBTQ19NQU5BR0VSX0NSRUFU
RV9TRVJWSUNFKSkpCg==

--------------KWqEOL5Ou9C8l1bbh1vtwN3o
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple

--------------KWqEOL5Ou9C8l1bbh1vtwN3o--