Conversation

Notices

1. Embed this notice
   Luis Guzman (ark74@toot.community)'s status on Thursday, 24-Oct-2024 15:47:13 JST Luis Guzman

   Saludos,

   Para todos los usuarios de #Guix en #Trisquel se les recomienda actualizar su sistema a la última actualización del mismo para corregir un detalle de seguridad encontrado en versiones recientes.

   No hay un CVE asignado, sin embargo podrán encontrar más información al respecto en: https://guix.gnu.org/blog/2024/build-user-takeover-vulnerability/

   Esta es una actualización "hecha en casa", al momento no hay aun una actualización desde Ubuntu o Debian.

   Gracias por su atención y happy hacking! 😀 👍
   #GNU #SoftwareLibre #LinuxLibre

   • Abhiseck Paira :gnu: repeated this.
   • Embed this notice
     Luis Guzman (ark74@toot.community)'s status on Thursday, 24-Oct-2024 15:47:11 JST Luis Guzman

     in reply to

     Hello,

     For all #Guix users in #Trisquel, it is recommended to update their system to the latest update to correct a security detail found in recent versions.

     There is no CVE assigned, however you can find more information about it at: https://guix.gnu.org/blog/2024/build-user-takeover-vulnerability/

     This is a "home-made" update, at the moment there is no update from Ubuntu or Debian yet.

     Thank you for your attention and happy hacking! 😀 👍
     #GNU #FreeSoftware #LibreLinux

   • Embed this notice
     翠星石 (suiseiseki@freesoftwareextremist.com)'s status on Thursday, 24-Oct-2024 15:49:40 JST 翠星石

     in reply to
     @ark74 >This exploit requires the ability to start a derivation build and the ability to run arbitrary code with access to the store in the root PID namespace on the machine the build occurs on.
     A nothingburger for many users tbh.