[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[bug#30827] [PATCH] gnu: util-linux: Fix CVE-2018-7738.
From: |
Leo Famulari |
Subject: |
[bug#30827] [PATCH] gnu: util-linux: Fix CVE-2018-7738. |
Date: |
Mon, 19 Mar 2018 16:52:21 -0400 |
User-agent: |
Mutt/1.9.3 (2018-01-21) |
On Mon, Mar 19, 2018 at 10:15:22AM +0100, Ludovic Courtès wrote:
> Hello!
>
> Leo Famulari <address@hidden> skribis:
>
> > * gnu/packages/patches/util-linux-CVE-2018-7738.patch: New file.
> > * gnu/local.mk (dist_patch_DATA): Add it.
> > * gnu/packages/linux.scm (util-linux)[replacement]: New field.
> > (util-linux/fixed): New variable.
>
> [...]
>
> > +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7738
> > +
> > +Patch copied from upstream source repository:
> > +
> > +https://github.com/karelzak/util-linux/commit/75f03badd7ed9f1dd951863d75e756883d3acc55
>
> I’m late to the party, but I’m wondering in this case if, instead of
> grafting, we should simply add an address@hidden package, and make
> sure GuixSD uses that one in %base-packages.
>
> That way, both GuixSD and manually installed util-linux would get the
> Bash completion fix. It’s probably OK that packages that depend on
> util-linux don’t get the fixed version because users don’t get bash
> completion from there.
>
> WDYT?
That's a good idea. I'll test and push today.
signature.asc
Description: PGP signature