Subject: Re: bug#47257: mariadb is vulnerable to CVE-2021-27928 (RCE)

From: zimoun <[email-masked]>
Date: Fri, 19 Mar 2021 12:35:11 +0100

Hi,

On Fri, 19 Mar 2021 at 11:25, Léo Le Bouter via Bug reports for GNU Guix <[email-masked]> wrote:

> Is it possible to graft mariadb you think? I am thinking this issue
> doesnt need updating of the "lib" output which is what's causing the
> high number of dependents AIUI. I am not sure we could actually update
> individual outputs right now though. Might be a good idea to split the
> packages for the future.

Instead of grafting, I would fix first check the compatibility between
mariadb  and zstd.  Because [email-masked] does not build with
[email-masked], at least on my machine.

Other said, I seem better to do this fix as a whole on core-updates
without any graft.  Instead of grafting here and there; and not
necessary small changes (zstd from 1.4.4 to 1.4.9, mariadb from 10.5.8
to 10.5.8).

All the best,
simon