Dear Maintainer,
zip bomb detection introduced in 6.0-24 (see #931433
<https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931433> and CVE-2019-13232)
causes unzip to reject many jar files distributed in the Java ecosystem.
Workaround is to downgrade to unzip 6.0-23.
Examples:
$ find .gradle .m2 java -name "*.jar" -type f -size +0c -print -exec unzip -tq
{} \; 2>&1 | grep -B1 invalid
.gradle/wrapper/dists/gradle-5.2.1-bin/9lc4nzslqh3ep7ml2tp68fk8s/gradle-5.2.1/lib/groovy-
all-1.0-2.5.4.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/gradle-
kotlin-dsl-5.4.1.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/plugins/gradle-
kotlin-dsl-tooling-builders-5.4.1.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/plugins/gradle-
kotlin-dsl-provider-plugins-5.4.1.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/groovy-
all-1.0-2.5.4.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.m2/repository/org/ow2/asm/asm-tree/5.0.3/asm-tree-5.0.3-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.m2/repository/org/ow2/asm/asm-util/5.0.3/asm-util-5.0.3-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.m2/repository/org/ow2/asm/asm/5.0.3/asm-5.0.3-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.m2/repository/org/ow2/asm/asm-analysis/5.0.3/asm-analysis-5.0.3-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.m2/repository/org/springframework/spring-orm/4.2.5.RELEASE/spring-
orm-4.2.5.RELEASE-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.m2/repository/org/springframework/spring-orm/4.3.7.RELEASE/spring-
orm-4.3.7.RELEASE-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.m2/repository/org/springframework/spring-beans/4.3.16.RELEASE/spring-
beans-4.3.16.RELEASE-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.m2/repository/org/springframework/spring-beans/4.2.5.RELEASE/spring-
beans-4.2.5.RELEASE-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.m2/repository/org/springframework/spring-beans/4.3.18.RELEASE/spring-
beans-4.3.18.RELEASE-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.m2/repository/org/springframework/spring-beans/4.3.7.RELEASE/spring-
beans-4.3.7.RELEASE-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
java/gradle-5.5.1/lib/plugins/gradle-kotlin-dsl-tooling-builders-5.5.1.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
java/gradle-5.5.1/lib/plugins/gradle-kotlin-dsl-provider-plugins-5.5.1.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
java/gradle-5.5.1/lib/gradle-kotlin-dsl-5.5.1.jar
error: invalid zip file with overlapped components (possible zip bomb)
java/gradle-5.5.1/lib/groovy-all-1.0-2.5.4.jar
error: invalid zip file with overlapped components (possible zip bomb)
Kind regards,
Ben.
gradle groovy false positive attached (this jar is the groovy bundled with gradle). Note that affected jars have been bundled into four separate zip files to thwart MTA spam filtering (which often rejects all jar files), and into several emails to avoid MTA size limits.
With the 17 affected jar files in the current working directory: unzip 6.0-23: $ for f in *.jar; do echo $f; unzip -tq $f; done asm-5.0.3-sources.jar No errors detected in compressed data of asm-5.0.3-sources.jar. asm-analysis-5.0.3-sources.jar No errors detected in compressed data of asm-analysis-5.0.3-sources.jar. asm-tree-5.0.3-sources.jar No errors detected in compressed data of asm-tree-5.0.3-sources.jar. asm-util-5.0.3-sources.jar No errors detected in compressed data of asm-util-5.0.3-sources.jar. gradle-kotlin-dsl-5.4.1.jar No errors detected in compressed data of gradle-kotlin-dsl-5.4.1.jar. gradle-kotlin-dsl-5.5.1.jar No errors detected in compressed data of gradle-kotlin-dsl-5.5.1.jar. gradle-kotlin-dsl-provider-plugins-5.4.1.jar No errors detected in compressed data of gradle-kotlin-dsl-provider-plugins-5.4.1.jar. gradle-kotlin-dsl-provider-plugins-5.5.1.jar No errors detected in compressed data of gradle-kotlin-dsl-provider-plugins-5.5.1.jar. gradle-kotlin-dsl-tooling-builders-5.4.1.jar No errors detected in compressed data of gradle-kotlin-dsl-tooling-builders-5.4.1.jar. gradle-kotlin-dsl-tooling-builders-5.5.1.jar No errors detected in compressed data of gradle-kotlin-dsl-tooling-builders-5.5.1.jar. groovy-all-1.0-2.5.4.jar No errors detected in compressed data of groovy-all-1.0-2.5.4.jar. spring-beans-4.2.5.RELEASE-sources.jar No errors detected in compressed data of spring-beans-4.2.5.RELEASE-sources.jar. spring-beans-4.3.16.RELEASE-sources.jar No errors detected in compressed data of spring-beans-4.3.16.RELEASE-sources.jar. spring-beans-4.3.18.RELEASE-sources.jar No errors detected in compressed data of spring-beans-4.3.18.RELEASE-sources.jar. spring-beans-4.3.7.RELEASE-sources.jar No errors detected in compressed data of spring-beans-4.3.7.RELEASE-sources.jar. spring-orm-4.2.5.RELEASE-sources.jar No errors detected in compressed data of spring-orm-4.2.5.RELEASE-sources.jar. spring-orm-4.3.7.RELEASE-sources.jar No errors detected in compressed data of spring-orm-4.3.7.RELEASE-sources.jar. unzip 6.0-24: $ for f in *.jar; do echo $f; unzip -tq $f; done asm-5.0.3-sources.jar error: invalid zip file with overlapped components (possible zip bomb) asm-analysis-5.0.3-sources.jar error: invalid zip file with overlapped components (possible zip bomb) asm-tree-5.0.3-sources.jar error: invalid zip file with overlapped components (possible zip bomb) asm-util-5.0.3-sources.jar error: invalid zip file with overlapped components (possible zip bomb) gradle-kotlin-dsl-5.4.1.jar error: invalid zip file with overlapped components (possible zip bomb) gradle-kotlin-dsl-5.5.1.jar error: invalid zip file with overlapped components (possible zip bomb) gradle-kotlin-dsl-provider-plugins-5.4.1.jar error: invalid zip file with overlapped components (possible zip bomb) gradle-kotlin-dsl-provider-plugins-5.5.1.jar error: invalid zip file with overlapped components (possible zip bomb) gradle-kotlin-dsl-tooling-builders-5.4.1.jar error: invalid zip file with overlapped components (possible zip bomb) gradle-kotlin-dsl-tooling-builders-5.5.1.jar error: invalid zip file with overlapped components (possible zip bomb) groovy-all-1.0-2.5.4.jar error: invalid zip file with overlapped components (possible zip bomb) spring-beans-4.2.5.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) spring-beans-4.3.16.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) spring-beans-4.3.18.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) spring-beans-4.3.7.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) spring-orm-4.2.5.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) spring-orm-4.3.7.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) Kind regards,
gradle false positives attached.
asm false positives attached .
spring false positives attached.
Hello. I applied your fix for the zip bomb issue to the Debian unzip package and shortly afterwards I received this bug report from one of our users (Ben Caradoc-Davies, in the Cc). (Note: Our BTS is email-based, but I could also put an issue on github if you prefer). The full report is available here: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931895 Thanks.----- Forwarded message from Ben Caradoc-Davies <ben@transient.nz> ----- Date: Fri, 12 Jul 2019 11:52:14 +1200 From: Ben Caradoc-Davies <ben@transient.nz> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: Bug#931895: unzip: zip bomb false positives in Java ecosystem X-Mailer: reportbug 7.5.2 Package: unzip Version: 6.0-24 Severity: normal Dear Maintainer, zip bomb detection introduced in 6.0-24 (see #931433 <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931433> and CVE-2019-13232) causes unzip to reject many jar files distributed in the Java ecosystem. Workaround is to downgrade to unzip 6.0-23. Examples: $ find .gradle .m2 java -name "*.jar" -type f -size +0c -print -exec unzip -tq {} \; 2>&1 | grep -B1 invalid .gradle/wrapper/dists/gradle-5.2.1-bin/9lc4nzslqh3ep7ml2tp68fk8s/gradle-5.2.1/lib/groovy- all-1.0-2.5.4.jar error: invalid zip file with overlapped components (possible zip bomb) -- .gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/gradle- kotlin-dsl-5.4.1.jar error: invalid zip file with overlapped components (possible zip bomb) -- .gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/plugins/gradle- kotlin-dsl-tooling-builders-5.4.1.jar error: invalid zip file with overlapped components (possible zip bomb) -- .gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/plugins/gradle- kotlin-dsl-provider-plugins-5.4.1.jar error: invalid zip file with overlapped components (possible zip bomb) -- .gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/groovy- all-1.0-2.5.4.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/ow2/asm/asm-tree/5.0.3/asm-tree-5.0.3-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/ow2/asm/asm-util/5.0.3/asm-util-5.0.3-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/ow2/asm/asm/5.0.3/asm-5.0.3-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/ow2/asm/asm-analysis/5.0.3/asm-analysis-5.0.3-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-orm/4.2.5.RELEASE/spring- orm-4.2.5.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-orm/4.3.7.RELEASE/spring- orm-4.3.7.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-beans/4.3.16.RELEASE/spring- beans-4.3.16.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-beans/4.2.5.RELEASE/spring- beans-4.2.5.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-beans/4.3.18.RELEASE/spring- beans-4.3.18.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-beans/4.3.7.RELEASE/spring- beans-4.3.7.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- java/gradle-5.5.1/lib/plugins/gradle-kotlin-dsl-tooling-builders-5.5.1.jar error: invalid zip file with overlapped components (possible zip bomb) -- java/gradle-5.5.1/lib/plugins/gradle-kotlin-dsl-provider-plugins-5.5.1.jar error: invalid zip file with overlapped components (possible zip bomb) -- java/gradle-5.5.1/lib/gradle-kotlin-dsl-5.5.1.jar error: invalid zip file with overlapped components (possible zip bomb) java/gradle-5.5.1/lib/groovy-all-1.0-2.5.4.jar error: invalid zip file with overlapped components (possible zip bomb) Kind regards, Ben.----- End forwarded message -----
Hello. I applied your fix for the zip bomb issue to the Debian unzip package and shortly afterwards I received this bug report from one of our users (Ben Caradoc-Davies, in the Cc). (Note: Our BTS is email-based, but I could also put an issue on github if you prefer). The full report is available here: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931895 Thanks.----- Forwarded message from Ben Caradoc-Davies <ben@transient.nz> ----- Date: Fri, 12 Jul 2019 11:52:14 +1200 From: Ben Caradoc-Davies <ben@transient.nz> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: Bug#931895: unzip: zip bomb false positives in Java ecosystem X-Mailer: reportbug 7.5.2 Package: unzip Version: 6.0-24 Severity: normal Dear Maintainer, zip bomb detection introduced in 6.0-24 (see #931433 <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931433> and CVE-2019-13232) causes unzip to reject many jar files distributed in the Java ecosystem. Workaround is to downgrade to unzip 6.0-23. Examples: $ find .gradle .m2 java -name "*.jar" -type f -size +0c -print -exec unzip -tq {} \; 2>&1 | grep -B1 invalid .gradle/wrapper/dists/gradle-5.2.1-bin/9lc4nzslqh3ep7ml2tp68fk8s/gradle-5.2.1/lib/groovy- all-1.0-2.5.4.jar error: invalid zip file with overlapped components (possible zip bomb) -- .gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/gradle- kotlin-dsl-5.4.1.jar error: invalid zip file with overlapped components (possible zip bomb) -- .gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/plugins/gradle- kotlin-dsl-tooling-builders-5.4.1.jar error: invalid zip file with overlapped components (possible zip bomb) -- .gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/plugins/gradle- kotlin-dsl-provider-plugins-5.4.1.jar error: invalid zip file with overlapped components (possible zip bomb) -- .gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/groovy- all-1.0-2.5.4.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/ow2/asm/asm-tree/5.0.3/asm-tree-5.0.3-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/ow2/asm/asm-util/5.0.3/asm-util-5.0.3-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/ow2/asm/asm/5.0.3/asm-5.0.3-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/ow2/asm/asm-analysis/5.0.3/asm-analysis-5.0.3-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-orm/4.2.5.RELEASE/spring- orm-4.2.5.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-orm/4.3.7.RELEASE/spring- orm-4.3.7.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-beans/4.3.16.RELEASE/spring- beans-4.3.16.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-beans/4.2.5.RELEASE/spring- beans-4.2.5.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-beans/4.3.18.RELEASE/spring- beans-4.3.18.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-beans/4.3.7.RELEASE/spring- beans-4.3.7.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- java/gradle-5.5.1/lib/plugins/gradle-kotlin-dsl-tooling-builders-5.5.1.jar error: invalid zip file with overlapped components (possible zip bomb) -- java/gradle-5.5.1/lib/plugins/gradle-kotlin-dsl-provider-plugins-5.5.1.jar error: invalid zip file with overlapped components (possible zip bomb) -- java/gradle-5.5.1/lib/gradle-kotlin-dsl-5.5.1.jar error: invalid zip file with overlapped components (possible zip bomb) java/gradle-5.5.1/lib/groovy-all-1.0-2.5.4.jar error: invalid zip file with overlapped components (possible zip bomb) Kind regards, Ben.----- End forwarded message -----
Santiago, Thank you for the report. I downloaded the four false-positive zip files from the bugreport page, and none of them showed a zip bomb error (or any other error). How exactly did you apply the fix? Did you download the complete source from github? Or did you try to selectively apply a commit? Mark
I applied the commits I believed to be the fix for the zipbomb issue, i.e. these two: commit 41beb477c5744bc396fa1162ee0c14218ec12213 Fix bug in undefer_input() that misplaced the input state. commit 47b3ceae397d21bf822bc2ac73052a4b1daf8e1c Detect and reject a zip bomb using overlapped entries. (The Debian version in turn had already a bunch of other changes to fix other CVE issues and other misc fixes, I hope there are not incompatibilities). Thanks.
Well, apparently there is an incompatibility. I can make no promises about applying those commits to an unzip source of unknown provenance. Where do I find this source?
I understand, that's why I also contacted Steven Schweda for the zipbomb issue. The source is distributed as the original tarball (which you already have) plus this: http://deb.debian.org/debian/pool/main/u/unzip/unzip_6.0-24.debian.tar.xz [ We use quilt here. Patches are in debian/patches and they are applied sequentially in the order stated by debian/patches/series ]. Thanks.
Mark, the zip bomb error is seen when unzipping the 17 jar files contained within the four zip files. Did you test these inner jar files? I used (in bash): $ for f in *.jar; do echo $f; unzip -tq $f; done The outer zip files are there because many email filters block all email with jar attachments, and Debian BTS is email-based. It would also be nice if unzip reported the filename when rejecting a suspected zip bomb, as it does when reporting "No errors detected". Kind regards,
Ben, Ah, no, I did not test the jar files. I just did, and indeed I am seeing the reported zip bomb detections. Thanks. I’ll look into it. Mark
All, Ok, I looked into it. Those jar files are seriously messed up. Any self-respecting unzipper would be well within its rights to reject them as invalid. As it turns out, my patch to unzip is doing exactly what it’s supposed to. Something that processed those jar files has a bug. In each of those .jar files there are several entries that are duplicated in a screwy way. First, those entries each have an exactly duplicated central directory entry, with the same file name, pointing to the same local header offset in the jar file. You can see this even using an unpatched unzip, asking it to unzip the jar file. It will extract a bunch of files, and then ask you if you’d like to replace a file it just unzipped when it encounters the duplicated central directory entry. The fact that two central directory entries are pointing to the same local header is what is, rightly, setting off the zip bomb detection in the patched unzip. Second, the other screwy thing is that there are a bunch of vestigial blocks of data in those jar files that are not referred to by any central directory entry. I presume that those are the data for those same files that were intended to be pointed to by the duplicated central directory entries, but were orphaned when the offsets to the local headers were not changed for those entries. Of course, even if the offsets had been changed so that all the data in the jar file were actually used, it would still be invalid due to having the same names appear more than once. The bug that resulted in these jar files might be even more serious if the duplicated entries are pointing to a previous version of those entries, and what was intended was to update those entries to what is now in the orphaned vestigial regions. Hopefully that’s not that the case. In summary, those jar files are grossly invalid zip files for three reasons: 1. The same name appears twice, 2. Two central directory entries point to the same local header (setting off zip bomb detection), and 3. There is an orphaned chunk of the file that is not referred to by any central directory header. As one example, all three of those things each occur 115 times in asm-5.0.3-sources.jar, out of 261 original central directory entries. Were it to be fixed, that jar file would have 146 unique entries, and would be quite a bit smaller. Which in addition to being invalid is also unfortunate and inefficient, since compression is kinda the point of the zip format. Mark
Thanks a lot, Mark, for such a comprehensive reply! I'll ask the submitter where exactly those files come from, but there is indeed little to do on my side. Thanks.
Hi. According to Mark Adler, those jar files are buggy: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931895#73 Simple question: Do those jar files come from any package that we (Debian) distribute? If yes, I'd like to reassign the bug. If not, I guess closing the bug as "not really a bug" is the only sensible thing to do. Thanks.
Mark, thanks very much for your detailed analysis. Santiago, none of these jar files come from Debian. They are sourced from Maven Central, Gradle repositories, and the official Gradle binary distribution. I checked all the jar files included in Debian gradle 4.4.1-7, libgradle-core-java 4.4.1-7, and libgradle-plugins-java 4.4.1-7, with unzip 6.0-24 (zip bomb detection included) and no errors were detected. This bug may be of interest to the Debian gradle maintainers if they think any future upstream fix is suitable for backport, but if not, this bug should be closed as it does not seem to affect the version of Gradle in Debian sid (4.4.1-7). Please reassign or close as you see fit. Given that the affected jars are all built with Gradle, and that the current stable Gradle release (5.5.1) includes several affected jars themselves built with Gradle, the problem is likely in Gradle, or the JDK itself. In any case, the Gradle project are best positioned to investigate. I have forwarded this bug upstream to the Gradle project: Gradle jars "grossly invalid zip files" that trigger zip bomb detection [CVE-2019-13232] https://github.com/gradle/gradle/issues/9990 Kind regards,
Dear gradle maintainers: I've reassigned this bug to gradle after hearing the explanations from both Mark Adler here: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931895#73 and the bug submitter here: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931895#90 Thanks.
Hola amigo, por favor entiende que nuestras ONG, organizaciones requieren tu atención para que puedas gestionar un proyecto de desarrollo humanitario en tu ciudad valorado en (8.370.000,00 AC) por un período de 3 años. Contáctenos para obtener más información si está interesado y puede administrar un proyecto de programa de desarrollo humanitario dedicado a apoyar a niños en dificultades, pequeños empresarios y mujeres con los fondos mencionados anteriormente. Asegúrese de que todas sus respuestas se envíen directamente a esta dirección de correo electrónico privada únicamente en: ( info@globalcbm.online ) Esperamos sus respuestas.
Saludos desde el imperio de la élite mundial Illuminati. Llevamos a los pobres, necesitados y talentosos a la fama, la riqueza, el poder, el conocimiento y las conexiones empresariales y políticas. ¡Este es el momento perfecto para que pongas fin a todas tus preocupaciones, problemas de salud y dificultades financieras uniéndote a la familia de élite Illuminati! ¿Estás enfermo, tienes problemas de fertilidad o divorcio, o te resulta difícil conseguir ascensos en tu trabajo para alcanzar el éxito que deseas en la vida? Si es así, únete al imperio Illuminati y obtendrás numerosos beneficios y soluciones a tus problemas. Nota: Este correo electrónico se creó únicamente para nuestro programa de reclutamiento, que finaliza el próximo mes. Esta oferta es exclusiva para personas con un perfil único. Si no estás realmente interesado en unirte al imperio Illuminati, te recomendamos no contactarnos. La deslealtad no se tolera en nuestra organización. ¿Aceptas ser miembro del nuevo orden mundial Illuminati? Si es así, Por favor, respóndanos únicamente a nuestro correo electrónico de reclutamiento: info@illuminatiinvite.online Tenga en cuenta que todas sus respuestas deben enviarse directamente a la dirección de correo electrónico mencionada anteriormente: info@illuminatiinvite.online Para obtener más información sobre nuestro proceso de membresía, contáctenos. Nota: Algunos proveedores de correo electrónico colocan incorrectamente los mensajes oficiales de los Illuminati en la carpeta de spam/correo no deseado o en la carpeta de promociones. Esto puede provocar que no reciba nuestras respuestas. Los Illuminati.