From 67da1cea0d21bae39c5badaaf37244efcd622ba1 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 24 Sep 2022 04:55:33 +0000 Subject: [PATCH 01/10] batik: 1.14 -> 1.15 (cherry picked from commit 0b0cef29155cd5e4a97961ccd35b56ab3e80d4d3) --- pkgs/applications/graphics/batik/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/graphics/batik/default.nix b/pkgs/applications/graphics/batik/default.nix index a88209bfbd89..b1259a543c73 100644 --- a/pkgs/applications/graphics/batik/default.nix +++ b/pkgs/applications/graphics/batik/default.nix @@ -2,11 +2,11 @@ stdenv.mkDerivation rec { pname = "batik"; - version = "1.14"; + version = "1.15"; src = fetchurl { url = "mirror://apache/xmlgraphics/batik/binaries/batik-bin-${version}.tar.gz"; - sha256 = "sha256-D06qgb5wdS5AahnznDnAGISPCZY/CPqJdGQFRwUsRhg="; + sha256 = "sha256-NYo7+8DikUmDsioM1Q1YW1s3KwsQeTnwIKDr+RHxxyo="; }; meta = with lib; { From 92eb434a1e6d1ff3f3e2fb944fc2d26607ae4d53 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 28 Oct 2022 05:11:25 +0000 Subject: [PATCH 02/10] batik: 1.15 -> 1.16 (cherry picked from commit fc7a1f33c9e00e46c3f114f458d402a269574a5b) --- pkgs/applications/graphics/batik/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/graphics/batik/default.nix b/pkgs/applications/graphics/batik/default.nix index b1259a543c73..5a45d88a985a 100644 --- a/pkgs/applications/graphics/batik/default.nix +++ b/pkgs/applications/graphics/batik/default.nix @@ -2,11 +2,11 @@ stdenv.mkDerivation rec { pname = "batik"; - version = "1.15"; + version = "1.16"; src = fetchurl { url = "mirror://apache/xmlgraphics/batik/binaries/batik-bin-${version}.tar.gz"; - sha256 = "sha256-NYo7+8DikUmDsioM1Q1YW1s3KwsQeTnwIKDr+RHxxyo="; + sha256 = "sha256-Y4bJ6X46sKx1+fmNkOS2RU7gn7n0fKDnkOYMq0S8fYM="; }; meta = with lib; { From ef1139421900e8d3c29998c90e63e01c20922c31 Mon Sep 17 00:00:00 2001 From: Robert Scott Date: Sat, 19 Nov 2022 00:29:37 +0000 Subject: [PATCH 03/10] fluentd: add patch for CVE-2022-39379 --- pkgs/tools/misc/fluentd/default.nix | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/pkgs/tools/misc/fluentd/default.nix b/pkgs/tools/misc/fluentd/default.nix index 82ea02aae680..7010c4f71bc9 100644 --- a/pkgs/tools/misc/fluentd/default.nix +++ b/pkgs/tools/misc/fluentd/default.nix @@ -1,4 +1,4 @@ -{ lib, bundlerEnv, ruby, bundlerUpdateScript }: +{ lib, bundlerEnv, ruby, bundlerUpdateScript, defaultGemConfig, fetchpatch }: bundlerEnv { inherit ruby; @@ -6,6 +6,19 @@ bundlerEnv { pname = "fluentd"; gemdir = ./.; + gemConfig = defaultGemConfig // { + fluentd = attrs: { + dontBuild = false; + patches = [ + (fetchpatch { + name = "CVE-2022-39379.patch"; + url = "https://github.com/fluent/fluentd/commit/48e5b85dab1b6d4c273090d538fc11b3f2fd8135.patch"; + hash = "sha256-BNREUXe8EQ1rsJSXUFVGyuDyC6XX2uEDTke+WarK/Vg="; + }) + ]; + }; + }; + passthru.updateScript = bundlerUpdateScript "fluentd"; meta = with lib; { From d8e7655a19510651b132c0daca76d014ae82d5e1 Mon Sep 17 00:00:00 2001 From: Nicolas Benes Date: Tue, 15 Nov 2022 00:50:02 +0100 Subject: [PATCH 04/10] cups-kyocera: fix source URL (cherry picked from commit 79059c9505281998dbfee0b7422ca28390e8bee9) --- pkgs/misc/cups/drivers/kyocera/default.nix | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/pkgs/misc/cups/drivers/kyocera/default.nix b/pkgs/misc/cups/drivers/kyocera/default.nix index cd4c049e67f7..7b2b6a2ed08f 100644 --- a/pkgs/misc/cups/drivers/kyocera/default.nix +++ b/pkgs/misc/cups/drivers/kyocera/default.nix @@ -17,9 +17,7 @@ stdenv.mkDerivation { dontStrip = true; src = fetchzip { - # this site does not like curl -> override useragent - curlOpts = "-A ''"; - url = "https://cdn.kyostatics.net/dlc/ru/driver/all/linuxdrv_1_1203_fs-1x2xmfp.-downloadcenteritem-Single-File.downloadcenteritem.tmp/LinuxDrv_1.1203_FS-1x2xMFP.zip"; + url = "https://web.archive.org/web/20220709011705/https://cdn.kyostatics.net/dlc/ru/driver/all/linuxdrv_1_1203_fs-1x2xmfp.-downloadcenteritem-Single-File.downloadcenteritem.tmp/LinuxDrv_1.1203_FS-1x2xMFP.zip"; sha256 = "0z1pbgidkibv4j21z0ys8cq1lafc6687syqa07qij2qd8zp15wiz"; }; From 14c16fcbbbc7ef094dd3b91463bf036f8cefdcdd Mon Sep 17 00:00:00 2001 From: Michael Adler Date: Fri, 25 Nov 2022 16:30:26 +0100 Subject: [PATCH 05/10] ungoogled-chromium: 107.0.5304.110 -> 107.0.5304.122 (cherry picked from commit 9fa2f1bf3eb6e2561f9e776d8dc57e8afc0edc1d) --- .../networking/browsers/chromium/upstream-info.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json index 1d08aec3d487..542cd9413a38 100644 --- a/pkgs/applications/networking/browsers/chromium/upstream-info.json +++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json @@ -45,9 +45,9 @@ } }, "ungoogled-chromium": { - "version": "107.0.5304.110", - "sha256": "1k7yjsb4i7m8i5mk018v7z25r4x1ypyprz4hnyrn7vk2983lhdfk", - "sha256bin64": "06rlxwbvp7rpw2rdpnjzl1cn7cr1rwlb20wz8r0cndjcjyzd3rjj", + "version": "107.0.5304.122", + "sha256": "0f2jdvlnp1s5ia01lnqk0ykqji2x4ab9g4kxk637n4csf0i1gj85", + "sha256bin64": null, "deps": { "gn": { "version": "2022-09-14", @@ -56,8 +56,8 @@ "sha256": "1c0dvpp4im1hf277bs5w7rgqxz3g2bax266i2g6smi3pl7a8jpnp" }, "ungoogled-patches": { - "rev": "107.0.5304.110-1", - "sha256": "14z9qi9i9l7kjx7gf74lzs63bpxqyd3wbqqpsvzvqgr2v0cgqahx" + "rev": "107.0.5304.122-1", + "sha256": "109j5jvsbj9dylj8prz7bkzc8czjv2c8bm0albwnkyxymcpd3w6p" } } } From 816af9f07acb9aec014b702ce83a30d5edf4e2e3 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 27 Nov 2022 02:18:06 +0100 Subject: [PATCH 06/10] moodle: 3.11.6 -> 3.11.11 https://moodledev.io/general/releases/3.11/3.11.7 https://moodledev.io/general/releases/3.11/3.11.8 https://moodledev.io/general/releases/3.11/3.11.9 https://moodledev.io/general/releases/3.11/3.11.10 https://moodledev.io/general/releases/3.11/3.11.11 Fixes: CVE-2022-30596, CVE-2022-30597, CVE-2022-30598, CVE-2022-30599, CVE-2022-30600, CVE-2022-35649, CVE-2022-35650, CVE-2022-35651, CVE-2022-35652, CVE-2022-35653, CVE-2022-0323, CVE-2022-2986, CVE-2022-40208, CVE-2022-40313, CVE-2022-40314, CVE-2022-40315, CVE-2022-40316, CVE-2021-23414, CVE-2022-45149, CVE-2022-45150, CVE-2022-45151, CVE-2022-45152 --- pkgs/servers/web-apps/moodle/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/web-apps/moodle/default.nix b/pkgs/servers/web-apps/moodle/default.nix index 77f02e7a78cd..4e5f1fa97a79 100644 --- a/pkgs/servers/web-apps/moodle/default.nix +++ b/pkgs/servers/web-apps/moodle/default.nix @@ -1,7 +1,7 @@ { lib, stdenv, fetchurl, writeText, plugins ? [ ] }: let - version = "3.11.6"; + version = "3.11.11"; stableVersion = lib.concatStrings (lib.take 2 (lib.splitVersion version)); in stdenv.mkDerivation rec { @@ -10,7 +10,7 @@ in stdenv.mkDerivation rec { src = fetchurl { url = "https://download.moodle.org/stable${stableVersion}/${pname}-${version}.tgz"; - sha256 = "sha256-g3qHYkxiXb18vJ23THUw8ej+s5SgIkJpmjQmmARwQhs="; + sha256 = "sha256-BZgJNzQs2KuhTs1JMpQGQ8B6eONGDewvG4PnE3xwVE8="; }; phpConfig = writeText "config.php" '' From acac5492d1606bcd7b657b87841ff053028b5d60 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 12 Nov 2022 04:57:53 +0000 Subject: [PATCH 07/10] drogon: 1.8.1 -> 1.8.2 (cherry picked from commit d46a86208ae62e3d3bfcce21a068dc88b84c58ed) --- pkgs/development/libraries/drogon/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/drogon/default.nix b/pkgs/development/libraries/drogon/default.nix index 9cc3503acd6e..5cc4b3b896c7 100644 --- a/pkgs/development/libraries/drogon/default.nix +++ b/pkgs/development/libraries/drogon/default.nix @@ -9,13 +9,13 @@ stdenv.mkDerivation rec { pname = "drogon"; - version = "1.8.1"; + version = "1.8.2"; src = fetchFromGitHub { owner = "drogonframework"; repo = "drogon"; rev = "v${version}"; - sha256 = "sha256-XzSJABYuZaYlNL12bi0ykQ1OyNsvB1AQiSTBPWiTNYU="; + sha256 = "sha256-IpECYpPuheoLelEdgV+J26b+95fMfRmeQ44q6JvqRtw="; fetchSubmodules = true; }; From 06e12833249a289d73e0b9dc1df10a40ff133bc3 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 27 Nov 2022 02:38:50 +0100 Subject: [PATCH 08/10] ntfs3g: Patch arbitrary code execution Fixes: CVE-2022-40284 --- pkgs/tools/filesystems/ntfs-3g/default.nix | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/pkgs/tools/filesystems/ntfs-3g/default.nix b/pkgs/tools/filesystems/ntfs-3g/default.nix index fe0ae20f557b..4c804a79d5f3 100644 --- a/pkgs/tools/filesystems/ntfs-3g/default.nix +++ b/pkgs/tools/filesystems/ntfs-3g/default.nix @@ -1,4 +1,4 @@ -{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config +{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, pkg-config , gettext, mount, libuuid, kmod, macfuse-stubs, DiskArbitration , crypto ? false, libgcrypt, gnutls }: @@ -28,6 +28,16 @@ stdenv.mkDerivation rec { # https://github.com/tuxera/ntfs-3g/pull/39 ./autoconf-sbin-helpers.patch ./consistent-sbindir-usage.patch + (fetchpatch { + name = "CVE-2022-40284-1.patch"; + url = "https://github.com/tuxera/ntfs-3g/commit/18bfc676119a1188e8135287b8327b0760ba44a1.patch"; + hash = "sha256-CxM1kHYqQ1Dbwj0VEUtqEnWrB9aQy/O65FHWtcznwDQ="; + }) + (fetchpatch { + name = "CVE-2022-40284-2.patch"; + url = "https://github.com/tuxera/ntfs-3g/commit/76c3a799a97fbcedeeeca57f598be508ae2a1656.patch"; + hash = "sha256-riGev/z++VQdFkwdMYfBwJa3F8WR6yGDUf2SIsb1kD4="; + }) ]; configureFlags = [ From ca9e17753fc0da2b91f386dc32b128b7086f364e Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Sat, 5 Nov 2022 18:35:20 +0100 Subject: [PATCH 09/10] upx: apply patch for CVE-2021-20285 Did not bump to 4.0.0 yet because the 4.0.0 release is affected by CVE-2021-30500 and CVE-2021-30501. The patch for CVE-2021-30500 does not apply cleanly on top of 4.0.0. (cherry picked from commit e43e91a2a25a00141c9c35a6e498c55580304955) --- pkgs/tools/compression/upx/default.nix | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/pkgs/tools/compression/upx/default.nix b/pkgs/tools/compression/upx/default.nix index aff00402ed97..c556f31e6918 100644 --- a/pkgs/tools/compression/upx/default.nix +++ b/pkgs/tools/compression/upx/default.nix @@ -1,4 +1,4 @@ -{ lib, stdenv, fetchurl, ucl, zlib, perl }: +{ lib, stdenv, fetchurl, ucl, zlib, perl, fetchpatch }: stdenv.mkDerivation rec { pname = "upx"; @@ -10,6 +10,14 @@ stdenv.mkDerivation rec { buildInputs = [ ucl zlib perl ]; + patches = [ + (fetchpatch { + url = "https://github.com/upx/upx/commit/13bc031163863cb3866aa6cdc018dff0697aa5d4.patch"; + sha256 = "sha256-7uazgx1lOgHh2J7yn3yb1q9lTJsv4BbexdGlWRiAG/M="; + name = "CVE-2021-20285.patch"; + }) + ]; + preConfigure = '' export UPX_UCLDIR=${ucl} ''; From 2e0b6e678cd77391949f1eab538032c600de09e8 Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Sun, 27 Nov 2022 20:01:38 +0100 Subject: [PATCH 10/10] dropbear: apply patch for CVE-2021-36369 --- pkgs/tools/networking/dropbear/default.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/tools/networking/dropbear/default.nix b/pkgs/tools/networking/dropbear/default.nix index 1fd686735b7e..036c287de256 100644 --- a/pkgs/tools/networking/dropbear/default.nix +++ b/pkgs/tools/networking/dropbear/default.nix @@ -1,6 +1,7 @@ { stdenv, lib, fetchurl, glibc, zlib , enableStatic ? stdenv.hostPlatform.isStatic , sftpPath ? "/run/current-system/sw/libexec/sftp-server" +, fetchpatch }: stdenv.mkDerivation rec { @@ -27,6 +28,11 @@ stdenv.mkDerivation rec { # Allow sessions to inherit the PATH from the parent dropbear. # Otherwise they only get the usual /bin:/usr/bin kind of PATH ./pass-path.patch + (fetchpatch { + url = "https://github.com/mkj/dropbear/commit/210a9833496ed2a93b8da93924874938127ce0b5.patch"; + sha256 = "sha256-ufnE+2uTsG23m+a/LwHfOEPZ3mq53vdFktZrVFH3yk4="; + name = "CVE-2021-36369.patch"; + }) ]; buildInputs = [ zlib ] ++ lib.optionals enableStatic [ glibc.static zlib.static ];