GNU bug report logs - #37744
Insecure permissions on /var/guix/profiles/per-user (CVE-2019-18192)

Previous Next

Full log

Message #101 received at 37744 <at> debbugs.gnu.org (full text, mbox):

From: Tobias Geerinckx-Rice <me <at> tobias.gr>
To: 37744 <at> debbugs.gnu.org
Subject: Re: bug#37744: Per-user profile directory hijack (CVE-2019-17365 for
 Nix)
Date: Thu, 17 Oct 2019 21:01:39 +0200

[Message part 1 (text/plain, inline)]

Ludo',

Ludovic Courtès 写道：
> See https://issues.guix.gnu.org/issue/37744

Will this be automatically linkified?

> This issue was initially [reported by Michael Orlitzky for
> Nix](https://www.openwall.com/lists/oss-security/2019/10/09/4)
> ([CVE-2019-17365](https://nvd.nist.gov/vuln/detail?vulnId=CVE-2019-17365)).
>
> # Fix
>
> The [fix](https://issues.guix.gnu.org/issue/37744) consists in 
> letting

From the Oxford Dictionaries:
   1 (consist of) be composed or made up of
     (consist in) have as an essential feature

TIL.

> # Upgrading
>
> On multi-user systems, we recommend upgrading the daemon now.
>
> To upgrade the daemon on a “foreign distro”, run something along 
> these

Imperialist nitpick: why list the foreigners first?  :-)

Anti-imperialist nitpick: reversing the two allows using ‘other 
distributions’ instead of ‘foreign’ which always sounds a bit 
dismissive to my ears.

End nitpick.

Thank you for taking care of this from start to finish,

T G-R

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.