#33730 [PATCH] gnu: Singularity: Update to 2.6.1 [fixes CVE-2018-19295].

Message #5 received at submit@debbugs.gnu.org (full text, mbox, reply):

From: Leo Famulari <leo@famulari.name>

To: guix-patches@gnu.org

Subject: [PATCH] gnu: Singularity: Update to 2.6.1 [fixes CVE-2018-19295].

Date: Thu, 13 Dec 2018 15:48:39 -0500

Our Singularity package is not vulnerable to CVE-2018-19295 by default,
becuase that vulnerability is based on the 'mount', 'start', and
'action' Singularity binaries being installed setuid, which we do not do
in Guix.

* gnu/packages/linux.scm (singularity): Update to 2.6.1.
---
 gnu/packages/linux.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm
index 1cdf2bf47..de6439449 100644
--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@@ -2612,7 +2612,7 @@ thanks to the use of namespaces.")
 (define-public singularity
   (package
     (name "singularity")
-    (version "2.5.1")
+    (version "2.6.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/singularityware/singularity/"
@@ -2620,7 +2620,7 @@ thanks to the use of namespaces.")
                                   "/singularity-" version ".tar.gz"))
               (sha256
                (base32
-                "0f28dgf2qcy8ljjfix7p9q36q12j7rxyicfzzi4n0fl8zr8ab88g"))))
+                "1whx0hqqi1326scgdxxxa1d94vn95mnq0drid6s8wdp84ni4d3gk"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags
-- 
2.20.0

Message #8 received at 33730@debbugs.gnu.org (full text, mbox, reply):

From: Ludovic Courtès <ludo@gnu.org>

To: Leo Famulari <leo@famulari.name>

Cc: 33730@debbugs.gnu.org

Subject: Re: [bug#33730] [PATCH] gnu: Singularity: Update to 2.6.1 [fixes CVE-2018-19295].

Date: Thu, 13 Dec 2018 23:52:09 +0100

Hi Leo,

Leo Famulari <leo@famulari.name> skribis:

> Our Singularity package is not vulnerable to CVE-2018-19295 by default,
> becuase that vulnerability is based on the 'mount', 'start', and
> 'action' Singularity binaries being installed setuid, which we do not do
> in Guix.
>
> * gnu/packages/linux.scm (singularity): Update to 2.6.1.

LGTM.  Thanks for the patch and for the analysis!

Ludo’.

Message #13 received at 33730@debbugs.gnu.org (full text, mbox, reply):

From: Leo Famulari <leo@famulari.name>

To: Ludovic Courtès <ludo@gnu.org>

Cc: 33730@debbugs.gnu.org

Subject: Re: [bug#33730] [PATCH] gnu: Singularity: Update to 2.6.1 [fixes CVE-2018-19295].

Date: Sat, 15 Dec 2018 14:37:51 -0500

[Message part 1 (text/plain, inline)]

On Thu, Dec 13, 2018 at 11:52:09PM +0100, Ludovic Courtès wrote:
> LGTM.  Thanks for the patch and for the analysis!

Thanks! Pushed as edc6dd03240b8fe0a1530ce0e80637641903095e

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.