CVE-2018-16888,systemd: Mark as no-dsa for Jessie.
This is arguably a longstanding bug in the PID file logic and systemd is now stricter when a PID file is owned by an untrusted user. Since daemons and services in Debian are not untrusted, you would need some other vulnerability to exploit it and to be able to write into the PID file. In most circumstances PID files are writable only by root though. Given there were a lot of code changes, a backport does not seem to be proportionate at the moment. Feedback from other team members or the security team would be appreciated though.
Loading
Please register or sign in to comment