aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLudovic Courtès <ludo@gnu.org>2021-04-03 22:13:28 +0200
committerLudovic Courtès <ludo@gnu.org>2021-04-03 22:13:28 +0200
commitc9960ad67c7644225343e913d5fea620d97bb293 (patch)
tree3697e709e10b83f69d31be5e0501dca98a80db26
parent72f911bf059ec3d984dbc2d22e02165940cb9983 (diff)
downloadguix-c9960ad67c7644225343e913d5fea620d97bb293.tar
guix-c9960ad67c7644225343e913d5fea620d97bb293.tar.gz
news: Recommend upgrade for account activation vulnerability.
* etc/news.scm: Recommend upgrade.
-rw-r--r--etc/news.scm7
1 files changed, 7 insertions, 0 deletions
diff --git a/etc/news.scm b/etc/news.scm
index 9b23c7ca0f..adb81dd64b 100644
--- a/etc/news.scm
+++ b/etc/news.scm
@@ -31,6 +31,13 @@ escalation has been found in the code that creates user accounts on Guix
System---Guix on other distros is unaffected. The system is only vulnerable
during the activation of user accounts that do not already exist.
+This bug is fixed and Guix System users are advised to upgrade their system,
+with a command along the lines of:
+
+@example
+guix system reconfigure /run/current-system/configuration.scm
+@end example
+
The attack can happen when @command{guix system reconfigure} is running.
Running @command{guix system reconfigure} can trigger the creation of new user
accounts if the configuration specifies new accounts. If a user whose account