[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[bug#30827] [PATCH] gnu: util-linux: Fix CVE-2018-7738.
From: |
Ludovic Courtès |
Subject: |
[bug#30827] [PATCH] gnu: util-linux: Fix CVE-2018-7738. |
Date: |
Mon, 19 Mar 2018 10:15:22 +0100 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/25.3 (gnu/linux) |
Hello!
Leo Famulari <address@hidden> skribis:
> * gnu/packages/patches/util-linux-CVE-2018-7738.patch: New file.
> * gnu/local.mk (dist_patch_DATA): Add it.
> * gnu/packages/linux.scm (util-linux)[replacement]: New field.
> (util-linux/fixed): New variable.
[...]
> +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7738
> +
> +Patch copied from upstream source repository:
> +
> +https://github.com/karelzak/util-linux/commit/75f03badd7ed9f1dd951863d75e756883d3acc55
I’m late to the party, but I’m wondering in this case if, instead of
grafting, we should simply add an address@hidden package, and make
sure GuixSD uses that one in %base-packages.
That way, both GuixSD and manually installed util-linux would get the
Bash completion fix. It’s probably OK that packages that depend on
util-linux don’t get the fixed version because users don’t get bash
completion from there.
WDYT?
Thanks,
Ludo’.