User avatar
🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca
14h
If you use the eloquence64 addon for the , a critical security release is now available. This is a critical update! Please update as soon as possible.

If you use Eloquence64 on secure screens, after the update, you must IMMEDIATELY! go to NVDA's settings dialogue, select eloquence from the list box, and press the "copy helper to system config" button again.

It fixes the following issues:
* fix: eloquence64 now clears its log file on start
* Fix: in some cases, eloquence64 could write to its log file at 30 megs per second
* fix: in some cases, eloquence64 created multiple temp files and directories that could not be removed
* fix: in some cases, eloquence64 could unexpectedly leave a port open on the computer
* fix: the port and key to communicate with eloquence could be intercepted by other processes running on the machine
* fix: in rare cases, it could have been possible for other processes on the user's machine to cause the addon to load and run arbitrary Python code by causing it to deserialize an attacker supplied pickle. If the addon was running on a secure screen, this would mean instant privilege escalation.
* fixed: crashing or frozen NVDA will no longer leave orphaned eloquence processes behind
* fix: more reliable pause and break lengths
* security hardening: switch to named pipes with DACL for IPC, ensuring no other process can use the 32-bit host

Release page: github.com/fastfinge/eloquence_64/releases/tag/v21

Direct download: github.com/fastfinge/eloquence_64/releases/download/v21/Eloquence-v21.nvda-addon
1
14
3
0
User avatar
Ethin Probst @draeand@the-gdn.net
8h
@fastfinge Hate to say it but these security issues with pickle are exactly why you shouldn't use pickle.
1
0
0
0
User avatar
🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca
3h
@draeand In my case, I need something fast and built in. It really is the best fit. The issue here was using tcp for ipc. That was a poor decision that just happened rather than being intentionally considered.
1
0
0
0
User avatar
Ethin Probst @draeand@the-gdn.net
1h
@fastfinge I mean, you could use flat buffers or similar. That’s not built-in perhaps but it also doesn’t come with the risk of arbitrary RCE vulnerabilities in your code if you choose to use IPC mechanisms like this or to allow third parties to interact with serialized data. The downside is it’s an external dependency, but it’s insanely fast. Pickle is something you should only use if you have absolute control over the data that you unpickle.
0
0
0
0