Subject: Re: [bug#33730] [PATCH] gnu: Singularity: Update to 2.6.1 [fixes CVE-2018-19295].

From: Ludovic Courtès <[email-masked]>
Date: Thu, 13 Dec 2018 23:52:09 +0100

Hi Leo,

Leo Famulari <[email-masked]> skribis:

> Our Singularity package is not vulnerable to CVE-2018-19295 by default,
> becuase that vulnerability is based on the 'mount', 'start', and
> 'action' Singularity binaries being installed setuid, which we do not do
> in Guix.
>
> * gnu/packages/linux.scm (singularity): Update to 2.6.1.

LGTM.  Thanks for the patch and for the analysis!

Ludo’.