Jagadeesh Krishnanjanappa a4ce8dbcc6 coreutils: CVE-2017-18018 ...

CVE-2017-18018-1:
doc: clarify chown/chgrp --dereference defaults
* doc/coreutils.texi: the documentation for the --dereference
  flag of chown/chgrp states that it is the default mode of
  operation. Document that this is only the case when operating
  non-recursively.

CVE-2017-18018-2:
doc: warn about following symlinks recursively in chown/chgrp
In both chown and chgrp (which shares its code with chown), operating
on symlinks recursively has a window of vulnerability where the
destination user or group can change the target of the operation.
Warn about combining the --dereference, --recursive, and -L flags.

* doc/coreutils.texi (warnOptDerefWithRec): Add macro.
(node chown invocation): Add it to --dereference and -L.
(node chgrp invocation): Likewise.

Affects coreutils <= 8.29

(From OE-Core rev: a523bc6a2ff7d5b5415a789de02fb055ccd2c077)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

2018-08-29 15:23:51 +01:00

..

coreutils

coreutils: CVE-2017-18018

2018-08-29 15:23:51 +01:00

coreutils_8.29.bb

coreutils: CVE-2017-18018

2018-08-29 15:23:51 +01:00