From 37397cdce43f3c7bd277e77dff0509365e62ad67 Mon Sep 17 00:00:00 2001 From: Robert Scott Date: Thu, 6 Apr 2023 17:21:30 +0100 Subject: [PATCH 01/14] minio: add patch for CVE-2023-25812 --- pkgs/servers/minio/default.nix | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix index 13c29ac6e399..0455f9e86aca 100644 --- a/pkgs/servers/minio/default.nix +++ b/pkgs/servers/minio/default.nix @@ -1,4 +1,4 @@ -{ lib, buildGoModule, fetchFromGitHub, nixosTests }: +{ lib, buildGoModule, fetchFromGitHub, nixosTests, fetchpatch }: let # The web client verifies, that the server version is a valid datetime string: @@ -24,6 +24,14 @@ buildGoModule rec { sha256 = "sha256-sABNzhyfBNU5pWyE/VWHUzuSyKsx0glj01ectJPakV8="; }; + patches = [ + (fetchpatch { + name = "CVE-2023-25812.patch"; + url = "https://github.com/minio/minio/commit/a7188bc9d0f0a5ae05aaf1b8126bcd3cb3fdc485.patch"; + sha256 = "sha256-9y7cua6r2hp+cK+rn2b4FMbHbmVXudFTt8ZffUEpkMQ="; + }) + ]; + vendorSha256 = "sha256-wB3UiuptT6D0CIUlHC1d5k0rjIxNeh5yAWOmYpyLGmA="; doCheck = false; From bc493df1a4eff86537cf3a391ea24d5722d19afc Mon Sep 17 00:00:00 2001 From: Robert Scott Date: Thu, 6 Apr 2023 18:43:04 +0100 Subject: [PATCH 02/14] geoserver: 2.21.2 -> 2.21.4 --- pkgs/servers/geospatial/geoserver/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/geospatial/geoserver/default.nix b/pkgs/servers/geospatial/geoserver/default.nix index ef9cbc7e1018..f1d3d9d832e8 100644 --- a/pkgs/servers/geospatial/geoserver/default.nix +++ b/pkgs/servers/geospatial/geoserver/default.nix @@ -2,11 +2,11 @@ stdenv.mkDerivation rec { pname = "geoserver"; - version = "2.21.2"; + version = "2.21.4"; src = fetchurl { url = "mirror://sourceforge/geoserver/GeoServer/${version}/geoserver-${version}-bin.zip"; - sha256 = "sha256-RL9a6AO6ZXD8NXWh49wwcNd+W5Nu2Ppl8daESR4mUoA="; + sha256 = "sha256-DIUQdR0WMK+iiPTPP9jkD8922rZx8jg7WAKgrJn+cpM="; }; sourceRoot = "."; From 30d026d1b52b1229c6a25d7f2a341f705f9274af Mon Sep 17 00:00:00 2001 From: rnhmjoj Date: Fri, 7 Apr 2023 09:43:55 +0200 Subject: [PATCH 03/14] pdns-recursor: 4.7.4 -> 4.7.5 --- pkgs/servers/dns/pdns-recursor/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/dns/pdns-recursor/default.nix b/pkgs/servers/dns/pdns-recursor/default.nix index 940ad6dd7394..ab48284c05a6 100644 --- a/pkgs/servers/dns/pdns-recursor/default.nix +++ b/pkgs/servers/dns/pdns-recursor/default.nix @@ -5,11 +5,11 @@ stdenv.mkDerivation rec { pname = "pdns-recursor"; - version = "4.7.4"; + version = "4.7.5"; src = fetchurl { url = "https://downloads.powerdns.com/releases/pdns-recursor-${version}.tar.bz2"; - sha256 = "F7XHyIHj9AC7O1J92GblzyzWLV0zVmsbcLWMYI2ZaNU="; + sha256 = "x+iNyGbXGo9TPy+UFRq73wUWwSJKWAYddkG8NE0IeIk="; }; nativeBuildInputs = [ pkg-config ]; From d5306ef3a35769c216eff5c41b26d1bbd3f75800 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Fri, 7 Apr 2023 09:59:49 +0200 Subject: [PATCH 04/14] xorg.xorgserver: patch CVE-2023-1393 https://lists.x.org/archives/xorg-announce/2023-March/003374.html --- pkgs/servers/x11/xorg/overrides.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix index 3045f637e330..26eb39d31b9a 100644 --- a/pkgs/servers/x11/xorg/overrides.nix +++ b/pkgs/servers/x11/xorg/overrides.nix @@ -851,6 +851,11 @@ self: super: url = "https://gitlab.freedesktop.org/xorg/xserver/-/commit/0ba6d8c37071131a49790243cdac55392ecf71ec.diff"; sha256 = "sha256-/+IuGk09OYVEIB/Y+DTKf7kfHyukEFX/6u1FDIGJieY="; }) + ] ++ [ + (fpgit "fb51d5dd53b02422ea3b6f36bd017488d41f472d" + "TyScXYJE+zHOovDrSiTUWuWg8nbCt/IIkNEPVRst/0Q=" + "CVE-2023-1393" + ) ]; buildInputs = commonBuildInputs ++ [ libdrm mesa ]; propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ libpciaccess libepoxy ] ++ commonPropagatedBuildInputs ++ lib.optionals stdenv.isLinux [ From 83f05c92c430589a6acaf2551a45333ae4e0bc31 Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Wed, 5 Apr 2023 11:12:59 +0000 Subject: [PATCH 05/14] linux: 4.14.311 -> 4.14.312 (cherry picked from commit 4615daf33930398af7fe4c7b7f0364bb6a65e23e) --- pkgs/os-specific/linux/kernel/linux-4.14.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix index ae8e8125bf50..4e1912d6e9f5 100644 --- a/pkgs/os-specific/linux/kernel/linux-4.14.nix +++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "4.14.311"; + version = "4.14.312"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz"; - sha256 = "1mbwrgjz575qxg4gwi2fxc94kprmiblwap3jix0mj4887zllqgw0"; + sha256 = "03bwrnm7z8jxxn681dd5jffrj76l14ngkcccfgbg1p4a0471q436"; }; } // (args.argsOverride or {})) From 71d735aa797aff9790c43a88d8b79986821e3984 Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Wed, 5 Apr 2023 11:13:19 +0000 Subject: [PATCH 06/14] linux: 4.19.279 -> 4.19.280 (cherry picked from commit dc762f7059d56e09525a6c4ff6a95040f0a337dc) --- pkgs/os-specific/linux/kernel/linux-4.19.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix index 208f67bdc636..f9691c864f35 100644 --- a/pkgs/os-specific/linux/kernel/linux-4.19.nix +++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "4.19.279"; + version = "4.19.280"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz"; - sha256 = "104qkyflkfkp8iyshpirb9q708vvsgfbxfwgl0dnas3k7nyc6v3k"; + sha256 = "1xmg9p3ky75n5q894f522s8nwcmbd5c15nmjr0n96m6xzag3kd7w"; }; } // (args.argsOverride or {})) From ca7595b79c51e49a7fddb07719b482fe0a6e73a8 Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Wed, 5 Apr 2023 11:13:36 +0000 Subject: [PATCH 07/14] linux: 5.10.176 -> 5.10.177 (cherry picked from commit c23e68f00a666427cd4e8972e38a884cb267d464) --- pkgs/os-specific/linux/kernel/linux-5.10.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix index e49fc9f01a44..515072be9389 100644 --- a/pkgs/os-specific/linux/kernel/linux-5.10.nix +++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "5.10.176"; + version = "5.10.177"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz"; - sha256 = "14zpdrrrpgxx44nxjn0rifrchnmsvvpkzpm1n82kw5q4p9h2q1yf"; + sha256 = "0waml6svj07b7f8yb1kzrflqlf61x4kcqbgsr372s484m3z628lz"; }; } // (args.argsOverride or {})) From 184b394fa4c0abefec8b9f07414555e69f48e973 Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Wed, 5 Apr 2023 11:13:53 +0000 Subject: [PATCH 08/14] linux: 5.15.105 -> 5.15.106 (cherry picked from commit 37a879586eaa28ea16a671729c52c5694ac92116) --- pkgs/os-specific/linux/kernel/linux-5.15.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix index 3ab936807c98..617b03a3472a 100644 --- a/pkgs/os-specific/linux/kernel/linux-5.15.nix +++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "5.15.105"; + version = "5.15.106"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz"; - sha256 = "0kz4ymaqb1kpniqq2mwv3z8rirz5yyf1c9m648kqblij0djkgd81"; + sha256 = "1r4g7ipcmj7k9dpwd5p2kd0f3iidnzl6z9g2cq4mfcw0h97r7rl4"; }; } // (args.argsOverride or { })) From 8b6c811bfb9213cbf52cc9cfd5b7b2178afba6d0 Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Wed, 5 Apr 2023 11:14:09 +0000 Subject: [PATCH 09/14] linux: 5.4.239 -> 5.4.240 (cherry picked from commit 7cc8cea05b8156d6ae91c5e7ec36a4fa011089ee) --- pkgs/os-specific/linux/kernel/linux-5.4.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix index 6a0d972f03cc..94d19aafe977 100644 --- a/pkgs/os-specific/linux/kernel/linux-5.4.nix +++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "5.4.239"; + version = "5.4.240"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz"; - sha256 = "0nw02lqkvachksyan4n11q0g6jhm1ii7d5zs276n46891ypn80m9"; + sha256 = "0ihf0rqhx7dav3k3igk29962sscb1xyniy2gx8chyllprr0z126w"; }; } // (args.argsOverride or {})) From ac22d9cc5d3b9dc83a1307065d598562860ad717 Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Wed, 5 Apr 2023 21:12:02 +0000 Subject: [PATCH 10/14] linux/hardened/patches/5.15: 5.15.104-hardened1 -> 5.15.105-hardened1 (cherry picked from commit 78a13a6a7174523cf00289f91e464e969bc8e096) --- pkgs/os-specific/linux/kernel/hardened/patches.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json index 323b54cae1d6..562c8772fdc3 100644 --- a/pkgs/os-specific/linux/kernel/hardened/patches.json +++ b/pkgs/os-specific/linux/kernel/hardened/patches.json @@ -32,12 +32,12 @@ "5.15": { "patch": { "extra": "-hardened1", - "name": "linux-hardened-5.15.104-hardened1.patch", - "sha256": "0gz3csflp34aadrgmlhy4y3sybxdlzvb2wsss9yb9l5zikxm2h1c", - "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.104-hardened1/linux-hardened-5.15.104-hardened1.patch" + "name": "linux-hardened-5.15.105-hardened1.patch", + "sha256": "0hkg9198ljp7hv5n5wv6dg2fh042wxlm1mzfk5adfylyl7rrm7js", + "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.105-hardened1/linux-hardened-5.15.105-hardened1.patch" }, - "sha256": "0m3bscml2mvafbj5k9a3qa8akfxms8wfpzsr687lfblr17735ibi", - "version": "5.15.104" + "sha256": "0kz4ymaqb1kpniqq2mwv3z8rirz5yyf1c9m648kqblij0djkgd81", + "version": "5.15.105" }, "5.4": { "patch": { From c3e26434a87608b778a487c103d8a6dc8e8390c3 Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Wed, 5 Apr 2023 23:10:48 +0000 Subject: [PATCH 11/14] linux/hardened/patches/5.4: 5.4.238-hardened1 -> 5.4.239-hardened1 (cherry picked from commit 1079847eb7ed8f1f16aa239f449f8da3a2f8d266) --- pkgs/os-specific/linux/kernel/hardened/patches.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json index 562c8772fdc3..e21ba1aeace5 100644 --- a/pkgs/os-specific/linux/kernel/hardened/patches.json +++ b/pkgs/os-specific/linux/kernel/hardened/patches.json @@ -42,12 +42,12 @@ "5.4": { "patch": { "extra": "-hardened1", - "name": "linux-hardened-5.4.238-hardened1.patch", - "sha256": "0fj3q8ykf9fi179hjspi5zq5bzxmn154g5nsdcvnphmizvlzy1qg", - "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.238-hardened1/linux-hardened-5.4.238-hardened1.patch" + "name": "linux-hardened-5.4.239-hardened1.patch", + "sha256": "12lmajxli4v84h3197xzyj21hyqdn4v596c24iirg72xch3ca5hw", + "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.239-hardened1/linux-hardened-5.4.239-hardened1.patch" }, - "sha256": "07x9ibcshsm451qcpawv3l0z7g8w8jg79h6dfdmbm3jrhpdb58kh", - "version": "5.4.238" + "sha256": "0nw02lqkvachksyan4n11q0g6jhm1ii7d5zs276n46891ypn80m9", + "version": "5.4.239" }, "6.1": { "patch": { From 3f57a12cf63ffea2d1ec4f9927b618e135b512e2 Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Wed, 5 Apr 2023 23:11:36 +0000 Subject: [PATCH 12/14] linux/hardened/patches/6.1: 6.1.21-hardened1 -> 6.1.22-hardened1 (cherry picked from commit 1d3d87b6b8fef7a773cc29a353fc025d64d309ee) --- pkgs/os-specific/linux/kernel/hardened/patches.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json index e21ba1aeace5..f1ad3d04951e 100644 --- a/pkgs/os-specific/linux/kernel/hardened/patches.json +++ b/pkgs/os-specific/linux/kernel/hardened/patches.json @@ -52,11 +52,11 @@ "6.1": { "patch": { "extra": "-hardened1", - "name": "linux-hardened-6.1.21-hardened1.patch", - "sha256": "04sksmh4zym2z8bjg8hdr1zv1fv1r08z1b5kyl7rm9b1ic3gd39w", - "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.21-hardened1/linux-hardened-6.1.21-hardened1.patch" + "name": "linux-hardened-6.1.22-hardened1.patch", + "sha256": "1nwjchs8jlishdcxc4f5834d7p03f1iiyhbp1gv2j1b48qrlf17l", + "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.22-hardened1/linux-hardened-6.1.22-hardened1.patch" }, - "sha256": "0fnr2pw4pi0vnkpv8hfipya09cgdz6ghks7p6vdl2d71dawb2g5k", - "version": "6.1.21" + "sha256": "1a7xkjqj13q5dgk1gml27kdzs381p0z203alamd0wkgprr0r3s1b", + "version": "6.1.22" } } From 08881a6a2e4b229491abb64e9a3b64f275c49f8e Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Fri, 7 Apr 2023 08:14:30 +0000 Subject: [PATCH 13/14] linux: 6.1.22 -> 6.1.23 (cherry picked from commit 6c7690a5d67becf3bede2f7526bb2050a633c1ba) --- pkgs/os-specific/linux/kernel/linux-6.1.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-6.1.nix b/pkgs/os-specific/linux/kernel/linux-6.1.nix index ac7cd3cc4136..459b29710cc8 100644 --- a/pkgs/os-specific/linux/kernel/linux-6.1.nix +++ b/pkgs/os-specific/linux/kernel/linux-6.1.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "6.1.22"; + version = "6.1.23"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz"; - sha256 = "1a7xkjqj13q5dgk1gml27kdzs381p0z203alamd0wkgprr0r3s1b"; + sha256 = "1szblfmm8gx0am017y30ywc60b1gqarplgmcs5zy7bshhwp3fn3l"; }; } // (args.argsOverride or { })) From 4d5c2407340b13cebb769e8458cc46897f39374a Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Fri, 7 Apr 2023 08:15:36 +0000 Subject: [PATCH 14/14] linux: 6.2.9 -> 6.2.10 (cherry picked from commit 5dbf383ce0cb9c1912c370f843cabf2672b4c5e9) --- pkgs/os-specific/linux/kernel/linux-6.2.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-6.2.nix b/pkgs/os-specific/linux/kernel/linux-6.2.nix index 9b2a21a4af1a..5b941f88212d 100644 --- a/pkgs/os-specific/linux/kernel/linux-6.2.nix +++ b/pkgs/os-specific/linux/kernel/linux-6.2.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "6.2.9"; + version = "6.2.10"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = versions.pad 3 version; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz"; - sha256 = "1xa3znandhyn1ygbfv4cl83mwn33hphj1jdc59s0wgy0ck0ljd4h"; + sha256 = "1zm4xvxdy6sqqwcich46mr4dh3kpmp40bawwahrg4lr7rp1n5iap"; }; } // (args.argsOverride or { }))