Investigating eMudhra certificate trust on macOS curl, LibreSSL vs SecureTransport, Keychain restrictions, and why OS updates can undo security fixes.

Relay provides a safe and secure hi-tech warehousing, perfect for specialist equipment storage. Visit our site to find out more about storage solutions.

A security issue in Axway SecureTransport's mail templates allows an attacker with admin privileges to execute arbitrary code on the server.

Yay, this problem is now fixed in the latest nightly. cargo --version --verbose cargo 1.88.0-nightly (0e93c5bf6 2025-04-05) release: 1.88.0-nightly commit-hash: 0e93c5bf6a1d5ee7bc2af63d1afb16cd28793601 commit-date: 2025-04-05 host: aarch64-apple-darwin libgit2: 1.9.0 (sys:0.20.0 vendored) libcurl: 8.7.1 (sys:0.4.80+curl-8.12.1 system ssl:(SecureTransport) LibreSSL/3.3.6) ssl: OpenSSL 3.4.1 11 Feb 2025 os: Mac OS 15.4.0 [64-bit] github.com/rust-lang/rust #### Instructions missing from naked_asm blocks. opened 11:09AM - 05 Apr 25 UTC closed 04:59PM - 11 Apr 25 UTC ZiCog regression-from-stable-to-nightly P-high T-compiler I-unsound A-incr-comp C-bug Instructions are getting omitted from naked_asm blocks after fixing a compilatio…n error and then rebuilding with `cargo run`. A `cargo clean` and `cargo run` is then required to get a correct executable. As a minimal demonstration of this problem this code contains a deliberate error and fails to build: ``` #![feature(naked_functions)] #![no_main] use core::arch::naked_asm; #[unsafe(no_mangle)] #[naked] extern "C" fn add_u64(x: u64, y: u64) -> u64 { unsafe { naked_asm!("add x0, x0, w1", "ret") } } #[unsafe(no_mangle)] pub extern "C" fn main(_argc: isize, _argv: *const *const u8) -> isize { println!("{}", add_u64(3u64, 7u64)); 0 } ``` ``` cargo run Compiling rust_asm v0.1.0 (/Users/me/rust_asm) error: too few operands for instruction | note: instantiated into assembly here --> <inline asm>:5:1 | 5 | add x0, x0, w1 | ^^^^^^^^^^^^^^ ``` We fix the source by changing `w1` into `x1`. Which now builds without error but produces the wrong result: ``` #![feature(naked_functions)] #![no_main] use core::arch::naked_asm; #[unsafe(no_mangle)] #[naked] extern "C" fn add_u64(x: u64, y: u64) -> u64 { unsafe { naked_asm!("add x0, x0, x1", "ret") } } #[unsafe(no_mangle)] pub extern "C" fn main(_argc: isize, _argv: *const *const u8) -> isize { println!("{}", add_u64(3u64, 7u64)); 0 } ``` ``` cargo run Compiling rust_asm v0.1.0 (/Users/me/rust_asm) Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.14s Running `target/debug/rust_asm` 3 ``` Looking at the disassembled executable with `objdump -d target/debug/rust_asm | less` we find the `add` instruction is missing from the `add_u64()` function: ``` 00000001000018d0 <_add_u64>: 1000018d0: d65f03c0 ret ``` Rebuilding with `cargo clean` and `cargo run` then produces the correct result: ``` cargo clean Removed 41 files, 1.0MiB total cargo run Compiling rust_asm v0.1.0 (/Users/me/rust_asm) Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.36s Running `target/debug/rust_asm` 10 ``` And of course the `add` instruction is now in the executable where we expect it to be: ``` 00000001000018cc <_add_u64>: 1000018cc: 8b010000 add x0, x0, x1 1000018d0: d65f03c0 ret ``` ### Meta ``` rustc --version --verbose rustc 1.87.0-nightly (249cb8431 2025-03-12) binary: rustc commit-hash: 249cb84316401daf040832cdbb8a45e0f5ab6af8 commit-date: 2025-03-12 host: aarch64-apple-darwin release: 1.87.0-nightly LLVM version: 20.1.0 ```

A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the template is rendered (i.e., during email sending). Successful exploitation …

It seems that stupidity is contagious since yt-dlp-2025.06.09: "https protocol not found, recompile FFmpeg with openssl, gnutls or securetransport enabled." I don't blame yt-dlp, this is certainly necessary for access to YouTube Videos. * * *