unofficial mirror of guix-devel@gnu.org 
 help / color / mirror / code / Atom feed
* Re: Bug#1066113: guix: CVE-2024-27297
       [not found]         ` <87sf0p63cf.fsf@wireframe>
@ 2024-03-23 22:37           ` Vagrant Cascadian
  2024-03-24 13:23             ` pelzflorian (Florian Pelz)
  0 siblings, 1 reply; 2+ messages in thread
From: Vagrant Cascadian @ 2024-03-23 22:37 UTC (permalink / raw)
  To: Salvatore Bonaccorso, 1066113; +Cc: guix-devel, team

[-- Attachment #1: Type: text/plain, Size: 1617 bytes --]

Control: severity 1066113 serious

On 2024-03-16, Vagrant Cascadian wrote:
> On 2024-03-15, Salvatore Bonaccorso wrote:
>> On Fri, Mar 15, 2024 at 11:22:52AM -0700, Vagrant Cascadian wrote:
>>> On 2024-03-13, Vagrant Cascadian wrote:
>>> > On 2024-03-12, Vagrant Cascadian wrote:
>>> >> On 2024-03-12, Salvatore Bonaccorso wrote:
>> We had a look, and as per
>> https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b11b98d89550ce201b0de31401e822c55f4fa2a1
>> we think that it does not require a DSA, but a fix in the upcoming
>> point releases would be good.
>
> Oh my! I am a bit shocked by this honestly ... why is it treated as a
> minor security issue?
>
> I realize Guix is pretty niche in Debian... Nix is perhaps a little more
> widely used...
>
> For anyone with Guix or Nix installed, if I understand correctly, it
> basically allows arbitrarily replacing the source code for anything that
> you might build using Guix or Nix.
>
>
>> So can you submit it for the point releases? (make sure to adjust the
>> target distribution to bullseye respetively bookworm instead of
>> *-security).
>
> I can... although, I would like to make a kind and freindly nudge to
> reconsider a DSA if at all possible. :)

Thinking more on this... I worry that this issue is maybe more serious
than the Debian Security Team realizes?

If issues like this do not warrant a security update in Debian, I feel
the better course of action may be to remove Guix from Debian. I say
this reluctantly, with a heavy heart...

Marking as serious severity to reflect my opinion as the maintainer.


live well,
  vagrant

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: Bug#1066113: guix: CVE-2024-27297
  2024-03-23 22:37           ` Bug#1066113: guix: CVE-2024-27297 Vagrant Cascadian
@ 2024-03-24 13:23             ` pelzflorian (Florian Pelz)
  0 siblings, 0 replies; 2+ messages in thread
From: pelzflorian (Florian Pelz) @ 2024-03-24 13:23 UTC (permalink / raw)
  To: Vagrant Cascadian; +Cc: Salvatore Bonaccorso, 1066113, guix-devel, team

On 2024-03-16, Vagrant Cascadian wrote:
> For anyone with Guix or Nix installed, if I understand correctly, it
> basically allows arbitrarily replacing the source code for anything that
> you might build using Guix or Nix.

Yes, for multi-user systems and people running untrusted code in “guix
shell -CW” container isolation, there is risk.

Regards,
Florian


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2024-03-24 13:24 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
     [not found] <171027393892.3641451.11730504058514510368.reportbug@eldamar.lan>
     [not found] ` <874jdbvyux.fsf@contorta>
     [not found]   ` <87ttl96605.fsf@wireframe>
     [not found]     ` <87zfuz5p8j.fsf@wireframe>
     [not found]       ` <ZfSpQroFsnHvqvus@eldamar.lan>
     [not found]         ` <87sf0p63cf.fsf@wireframe>
2024-03-23 22:37           ` Bug#1066113: guix: CVE-2024-27297 Vagrant Cascadian
2024-03-24 13:23             ` pelzflorian (Florian Pelz)

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).