GNU bug report logs - #37744
Insecure permissions on /var/guix/profiles/per-user (CVE-2019-18192)

Previous Next

Full log

View this message in rfc822 format

From: Ludovic Courtès <ludo <at> gnu.org>
To: 37744 <at> debbugs.gnu.org,  guix-security <at> gnu.org
Subject: bug#37744: Per-user profile directory hijack (CVE-2019-17365 for Nix)
Date: Wed, 16 Oct 2019 15:25:56 +0200

Hello!

In addition to the news entry that ‘guix pull’ will display, we may want
to publicize the issue.  In particular, should we:

  1. Apply for a new CVE?

  2. Post an article on the blog to explain in detail what happened?
     That should probably include an analysis like that at
     <https://www.openwall.com/lists/oss-security/2019/10/09/4>, given
     that Guix does things not entirely like Nix here.

  3. Email that analysis to oss-security?

  4. Push a new release?

I’m tempted to think that we should do 1 to 3, as quickly as we can.
Help welcome, in particular on #2!

As for #4, I think we should push a new release soon anyway, but maybe
not just specifically for this issue since it can be addressed simply by
upgrading.

Thoughts?

Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.