bug#37744: Per-user profile directory hijack (CVE-2019-17365 for Nix)

[Tobias Geerinckx-Rice via Bug reports for GNU Guix <bug-guix@gnu.org>]

[-- Attachment #1: Type: text/plain, Size: 1042 bytes --]

Ludo',

Ludovic Courtès 写道：
> See https://issues.guix.gnu.org/issue/37744

Will this be automatically linkified?

> This issue was initially [reported by Michael Orlitzky for
> Nix](https://www.openwall.com/lists/oss-security/2019/10/09/4)
> ([CVE-2019-17365](https://nvd.nist.gov/vuln/detail?vulnId=CVE-2019-17365)).
>
> # Fix
>
> The [fix](https://issues.guix.gnu.org/issue/37744) consists in 
> letting

From the Oxford Dictionaries:
    1 (consist of) be composed or made up of
      (consist in) have as an essential feature

TIL.

> # Upgrading
>
> On multi-user systems, we recommend upgrading the daemon now.
>
> To upgrade the daemon on a “foreign distro”, run something along 
> these

Imperialist nitpick: why list the foreigners first?  :-)

Anti-imperialist nitpick: reversing the two allows using ‘other 
distributions’ instead of ‘foreign’ which always sounds a bit 
dismissive to my ears.

End nitpick.

Thank you for taking care of this from start to finish,

T G-R

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]