bug#37744: Per-user profile directory hijack (CVE-2019-17365 for Nix)

[Ludovic Courtès]

Hallo!

Tobias Geerinckx-Rice <address@hidden> skribis:

> Ludovic Courtès 写道：
>> See https://issues.guix.gnu.org/issue/37744
>
> Will this be automatically linkified?

Yes, I think so.

>> # Upgrading
>>
>> On multi-user systems, we recommend upgrading the daemon now.
>>
>> To upgrade the daemon on a “foreign distro”, run something along
>> these
>
> Imperialist nitpick: why list the foreigners first?  :-)
>
> Anti-imperialist nitpick: reversing the two allows using ‘other
> distributions’ instead of ‘foreign’ which always sounds a bit
> dismissive to my ears.
>
> End nitpick.

That makes sense to me; I’m not satisfied with “foreign” either (I think
the inspiration came from FFIs, but still).  Maybe “fellow distros”?
:-)

I’ve received the CVE ID (CVE-2019-18192) just now so I’ve added it to
the article and pushed it.

It should show up on line shortly.

Thank you for your feedback!

Ludo’.