Re: Vulnerability in pcs or is it in more generic code?

2022-09-05 Thread Paul Wise
On Mon, 2022-09-05 at 21:38 +0200, Ola Lundqvist wrote: > I agree that it is good to fix the pcs package, but shouldn't we fix > the default umask in general? > I would argue that the default umask is insecure. bookworm login sets new user home directories to secure permissions: $ grep -E 'HO

Vulnerability in pcs or is it in more generic code?

2022-09-05 Thread Ola Lundqvist
Hi fellow Debian LTS and Debian Security memebers When triaging the packages for LTS I looked into the package pcs. I saw that it was already added to DSA needed so I have added it to DLA needed as well. However when reading the correction for it I started to think that the vulnerability may not b