bug#36634: Virtual Machine Manager (virt-manager)

[Tobias Geerinckx-Rice via Bug reports for GNU Guix <bug-guix@gnu.org>]

[-- Attachment #1: Type: text/plain, Size: 1115 bytes --]

Chrisen,

Chris Marusich 写道：
> In the meantime, should we revert to version 5.4.0 in Guix?  I'm 
> not
> sure if there are any security vulnerabilities between 5.4.0 and 
> the
> most recent release, but this bug is currently preventing me 
> from
> creating any VMs at all in Guix using virt-manager, which is 
> pretty bad.

Yes! (which is why I originally updated this package):

  v5.5.0 (2019-07-02)
    Security
        api: Prevent access to several APIs over read-only 
        connections
            Certain APIs give root-equivalent access to the host, 
            and as
            such should be limited to privileged 
            users. CVE-2019-10161,
            CVE-2019-10166, CVE-2019-10167, CVE-2019-10168.

  ­ https://libvirt.org/news.html

It might be easy to backport.  I didn't try, and I no longer use 
libvirt myself.

What's weird (maybe; I haven't kept up with the thread) is that I 
used libvirt 5.5.0 (and yes, it was 5.5.0) for a while without 
problems.  I don't remember whether I created any *new* VMs, 
though.

Kind regards,

T G-R

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]