Have ya'll seen the news about the openssh vulnerablity?

Have ya'll seen the news about the openssh vulnerablity?

[jbranso]

Heyo,

Have you all seen this new openssh vulnerability?

Is guix affected?

https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server


Thanks,

Joshua

Re: Have ya'll seen the news about the openssh vulnerablity?

[Felix Lechner via Development of GNU Guix and the GNU System distribution.]

Hi Joshua,

On Mon, Jul 01 2024, jbranso@dismail.de wrote:

> Is guix affected?

Yes, our version is affected.  While the vulnerability is "critical,"
however, the note also states that the exploit has not yet been
demostrated on 64-bit systems, which are the most common today.

Also, this release disables DSA keys "at compile time."  Not sure how
that's different from before but it may be helpful to inlude a NEWS
entry.

Kind regards
Felix