Removing CXserver and sprint tags as it no longer applies to us.

CXServer removed the dependency on service-runner T357950: Remove servicerunner dependency for cxserver and deployed to production last week. Since service-runner and the associated service template had huge influence on how a nodejs servie is written, it was not an easy migration. This was also partly due to the fact that cxserver was written in 2015 and then grew to a complex system.

I think this can be closed.

See the previous three comments

@Aklapper are you okay to resolve this ticket?

If this has bitten us anywhere else, I'm not aware of it. I think it seems fine to resolve at this stage.

modules/profile/templates/idp/client/httpd-puppetboard-ng.erb is for https://puppetboard.wikimedia.org

I'm tempted to resolve this task tagged with Phabricator and create a separate one for MediaWiki-Vagrant (is the modules/profile/templates/idp/client/httpd-puppetboard-ng.erb result in Puppet relevant?) because I dislike fixed issues displayed as unresolved tasks in my backlog. Eh?

@jhathaway -

Would that be the extent of our exposure to this issue, in your estimation? e.g. is the above good enough to resolve this task? We'd need to defer to you and SRE on that assessment.

In T371569#10036720, @jhathaway wrote:

Our postfix servers have now been configured with the "long term fix", T370011, https://www.postfix.org/smtp-smuggling.html#back-ports

Our lists server has Exim4 4.96-15+deb12u4, which has a patch included to fix the attack vector according to https://security-tracker.debian.org/tracker/CVE-2023-51766

Our postfix servers have now been configured with the "long term fix", T370011, https://www.postfix.org/smtp-smuggling.html#back-ports

Doesn't look like a lot else in codesearch, at least - a couple in MediaWiki-Vagrant:

All instances updated, thanks again @eoghan and @Dzahn for preparing the update on the other instances!

In T370110#10007941, @Dzahn wrote:

In T370110#10005864, @hashar wrote:

• The phorge module in Puppet should be adjusted

Done

In T370110#10005864, @hashar wrote:

• The phorge module in Puppet should be adjusted

Change #1056207 merged by Dzahn:

[operations/puppet@production] phorge: add UnsafeAllow3F rewrite flag

https://gerrit.wikimedia.org/r/1056207

Change #1056207 had a related patch set uploaded (by Dzahn; author: Dzahn):

[operations/puppet@production] phorge: add UnsafeAllow3F rewrite flag

https://gerrit.wikimedia.org/r/1056207

Is the B flag the reason the issue triggers? From what I understand it encodes the requested URI before it is processed and surely any legit ones having a question mark will end up triggering it. Maybe the upstream code should have exempted those cases, then I don't understand the attack vector :-/ What I am wondering is what is the sufficient condition to trigger the error so that we can audit all of our RewriteRule.

Upstreamed as https://we.phorge.it/T15889

@Aklapper since the gerrit patch is public this ticket is okay to be public as well. I went ahead and changed the policy