From 3d695ad7a256ef92b60b80b18662f43bddc8473d Mon Sep 17 00:00:00 2001 From: Ruud van Asseldonk Date: Mon, 13 Feb 2023 19:41:42 +0100 Subject: [PATCH 1/4] libressl_3_6: 3.6.1 -> 3.6.2 This release contains a security fix. Release notes: https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt --- pkgs/development/libraries/libressl/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/libressl/default.nix b/pkgs/development/libraries/libressl/default.nix index e9f1a2d4bbdf..ce5b2be990b2 100644 --- a/pkgs/development/libraries/libressl/default.nix +++ b/pkgs/development/libraries/libressl/default.nix @@ -104,7 +104,7 @@ in { }; libressl_3_6 = generic { - version = "3.6.1"; - hash = "sha256-rPrGExbpO5GcKNYtUwN8pzTehcRrTXA/Gf2Dlc8AZ3Q="; + version = "3.6.2"; + hash = "sha256-S+gP/wc3Rs9QtKjlur4nlayumMaxMqngJRm0Rd+/0DM="; }; } From cae86017b1e51d60c828b0cbcae9b52104dddde1 Mon Sep 17 00:00:00 2001 From: Ruud van Asseldonk Date: Mon, 13 Feb 2023 19:43:54 +0100 Subject: [PATCH 2/4] libressl_3_5: 3.5.3 -> 3.5.4 This release includes a security fix. Release notes: https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.5.4-relnotes.txt --- pkgs/development/libraries/libressl/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/libressl/default.nix b/pkgs/development/libraries/libressl/default.nix index ce5b2be990b2..2ee9601fcbb7 100644 --- a/pkgs/development/libraries/libressl/default.nix +++ b/pkgs/development/libraries/libressl/default.nix @@ -90,8 +90,8 @@ in { }; libressl_3_5 = generic { - version = "3.5.3"; - hash = "sha256-OrXl6u9pziDGsXDuZNeFtCI19I8uYrCV/KXXtmcriyg="; + version = "3.5.4"; + hash = "sha256-A3naE0Si9xrUpOO+MO+dgu7N3Of43CrmZjGh3+FDQ6w="; patches = [ # Fix endianness detection on aarch64-darwin, issue #181187 From cb8d827b9a4c1863c37c0b124f78da93b3b5cb05 Mon Sep 17 00:00:00 2001 From: Ruud van Asseldonk Date: Tue, 14 Feb 2023 20:32:58 +0100 Subject: [PATCH 3/4] libressl_3_4: add knownVulnerabilities --- pkgs/development/libraries/libressl/default.nix | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/pkgs/development/libraries/libressl/default.nix b/pkgs/development/libraries/libressl/default.nix index 2ee9601fcbb7..658eaed36e63 100644 --- a/pkgs/development/libraries/libressl/default.nix +++ b/pkgs/development/libraries/libressl/default.nix @@ -12,7 +12,13 @@ let then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH"; - generic = { version, hash, patches ? [] }: stdenv.mkDerivation rec { + generic = + { version + , hash + , patches ? [] + , knownVulnerabilities ? [] + }: stdenv.mkDerivation rec + { pname = "libressl"; inherit version; @@ -80,6 +86,7 @@ let license = with licenses; [ publicDomain bsdOriginal bsd0 bsd3 gpl3 isc openssl ]; platforms = platforms.all; maintainers = with maintainers; [ thoughtpolice fpletz ]; + knownVulnerabilities = knownVulnerabilities; }; }; @@ -87,6 +94,10 @@ in { libressl_3_4 = generic { version = "3.4.3"; hash = "sha256-/4i//jVIGLPM9UXjyv5FTFAxx6dyFwdPUzJx1jw38I0="; + knownVulnerabilities = [ + "Support ended 2022-10-14." + "https://marc.info/?l=libressl&m=167582148932407&w=2" + ]; }; libressl_3_5 = generic { From b958f017b7f27de0064cbc3e1a16e2020f2acce3 Mon Sep 17 00:00:00 2001 From: Ruud van Asseldonk Date: Tue, 14 Feb 2023 21:00:47 +0100 Subject: [PATCH 4/4] libressl_3_4: backport security fix --- pkgs/development/libraries/libressl/default.nix | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/pkgs/development/libraries/libressl/default.nix b/pkgs/development/libraries/libressl/default.nix index 658eaed36e63..bb8271cfb44e 100644 --- a/pkgs/development/libraries/libressl/default.nix +++ b/pkgs/development/libraries/libressl/default.nix @@ -86,7 +86,7 @@ let license = with licenses; [ publicDomain bsdOriginal bsd0 bsd3 gpl3 isc openssl ]; platforms = platforms.all; maintainers = with maintainers; [ thoughtpolice fpletz ]; - knownVulnerabilities = knownVulnerabilities; + inherit knownVulnerabilities; }; }; @@ -94,9 +94,16 @@ in { libressl_3_4 = generic { version = "3.4.3"; hash = "sha256-/4i//jVIGLPM9UXjyv5FTFAxx6dyFwdPUzJx1jw38I0="; - knownVulnerabilities = [ - "Support ended 2022-10-14." - "https://marc.info/?l=libressl&m=167582148932407&w=2" + knownVulnerabilities = [ "Support ended 2022-10-14." ]; + patches = [ + (fetchpatch { + # https://marc.info/?l=libressl&m=167582148932407&w=2 + name = "backport-type-confusion-fix.patch"; + url = "https://raw.githubusercontent.com/libressl/portable/30dc760ed1d7c70766b135500950d8ca9d17b13a/patches/x509_genn.c.diff"; + sha256 = "sha256-N9jsOueqposDWZwaR+n/v/cHgNiZbZ644d8/wKjN2/M="; + stripLen = 2; + extraPrefix = "crypto/"; + }) ]; };