GNU bug report logs - #30827
[PATCH] gnu: util-linux: Fix CVE-2018-7738.

Previous Next

Full log

View this message in rfc822 format

From: ludo <at> gnu.org (Ludovic Courtès)
To: Leo Famulari <leo <at> famulari.name>
Cc: 30827 <at> debbugs.gnu.org, Marius Bakke <mbakke <at> fastmail.com>
Subject: [bug#30827] [PATCH] gnu: util-linux: Fix CVE-2018-7738.
Date: Mon, 19 Mar 2018 10:15:22 +0100

Hello!

Leo Famulari <leo <at> famulari.name> skribis:

> * gnu/packages/patches/util-linux-CVE-2018-7738.patch: New file.
> * gnu/local.mk (dist_patch_DATA): Add it.
> * gnu/packages/linux.scm (util-linux)[replacement]: New field.
> (util-linux/fixed): New variable.

[...]

> +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7738
> +
> +Patch copied from upstream source repository:
> +
> +https://github.com/karelzak/util-linux/commit/75f03badd7ed9f1dd951863d75e756883d3acc55

I’m late to the party, but I’m wondering in this case if, instead of
grafting, we should simply add an util-linux <at> 2.31a package, and make
sure GuixSD uses that one in %base-packages.

That way, both GuixSD and manually installed util-linux would get the
Bash completion fix.  It’s probably OK that packages that depend on
util-linux don’t get the fixed version because users don’t get bash
completion from there.

WDYT?

Thanks,
Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.