From b2cd103556b8521731d79c900a8e09c97ce7252f Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sat, 3 Dec 2022 14:37:34 +0100 Subject: [PATCH 1/5] botan2: Fix CVE-2022-43705 Backports security patches and regression tests. A complete fix would require an API change that is scheduled for the 3.0 release, which is out of scope. https://github.com/randombit/botan/security/advisories/GHSA-4v9w-qvcq-6q7w Fixes: CVE-2022-43705 --- pkgs/development/libraries/botan/2.0.nix | 41 ++++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/pkgs/development/libraries/botan/2.0.nix b/pkgs/development/libraries/botan/2.0.nix index 113c4a27b919..f436b2b47b1d 100644 --- a/pkgs/development/libraries/botan/2.0.nix +++ b/pkgs/development/libraries/botan/2.0.nix @@ -15,5 +15,46 @@ callPackage ./generic.nix (args // { # our source tarball doesn't include the tests excludes = [ "src/tests/*" ]; }) + # https://github.com/randombit/botan/security/advisories/GHSA-4v9w-qvcq-6q7w + (fetchpatch { + name = "CVE-2022-43705-1.patch"; + url = "https://github.com/randombit/botan/commit/fd83d9e262f63fb673e4c13ca37e5b768e41e812.patch"; + hash = "sha256-f0vZGXalao1jqtaONlZna4alzpyLF4BbZwirQN+MPs0="; + }) + (fetchpatch { + name = "CVE-2022-43705-2.patch"; + url = "https://github.com/randombit/botan/commit/4e35073ff356e37c3adcf1ff3522e9d0d48c765f.patch"; + hash = "sha256-BBoIMuI1ayesI0rhYbdlO6rphZE1C4LCYI7bwHd8bUw="; + }) + (fetchpatch { + name = "CVE-2022-43705-3.patch"; + url = "https://github.com/randombit/botan/commit/c2faa88b0281e5017be72e1c85d0c41f686e1928.patch"; + hash = "sha256-n88gRLrxQG5/cundLyajd1IEi7x4aS5Ou3a1BudTrXI="; + }) + (fetchpatch { + name = "CVE-2022-43705-4.patch"; + url = "https://github.com/randombit/botan/commit/5d8d9fbf75c8b814ea609161bee525d520f5cb57.patch"; + hash = "sha256-gqm9mG1NUyYfzMA3vjUjdU4aWOyHU4hiptpXGCR+HqM="; + }) + (fetchpatch { + name = "CVE-2022-43705-5.patch"; + url = "https://github.com/randombit/botan/commit/1829ef9d89614da1eacdf511356bdf98a970f5f5.patch"; + hash = "sha256-Whi4GOT6CPmV8qE2Q9ktJ11aozR8xvDV8h6bIRgxMPA="; + }) + (fetchpatch { + name = "CVE-2022-43705-6.patch"; + url = "https://github.com/randombit/botan/commit/991b0159282781f2d5c06ff42a9ff00ee563e96b.patch"; + hash = "sha256-vEgfAlE5Pl5V0kVsjFtxm51ODubs9nRi52l50AiaTsM="; + }) + (fetchpatch { + name = "CVE-2022-43705-7.patch"; + url = "https://github.com/randombit/botan/commit/a33689613127f319c0047fb96f092de16e7cb350.patch"; + hash = "sha256-3/l6RjPZDXTGPGwYVNDL/G213hCEIn0RV0JmNxOt4UI="; + }) + (fetchpatch { + name = "CVE-2022-43705-8.patch"; + url = "https://github.com/randombit/botan/commit/909c62717855402e04dbaf8ffc085f444d547aae.patch"; + hash = "sha256-AAsmNgwN8887nE84/BgJOcb6IuLK11HZoMJOhyeqDpI="; + }) ]; }) From 6c66ef16d112df3c797a87f7573fd9223149f65d Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Tue, 15 Nov 2022 22:59:44 +0100 Subject: [PATCH 2/5] nixos/profiles/base: install vim w/nix-syntax plugin Considering that you most likely edit Nix code in the installer, that seems like a useful thing. The size of the ISO I got from nix-build nixos/release.nix -A iso_minimal.x86_64-linux is still at 877M. (cherry picked from commit 0b5a0cbc69f18f2a123bf4ae0751ee718ef04e53) --- nixos/modules/profiles/base.nix | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/nixos/modules/profiles/base.nix b/nixos/modules/profiles/base.nix index 33dd80d7c5ab..0a68eac62b79 100644 --- a/nixos/modules/profiles/base.nix +++ b/nixos/modules/profiles/base.nix @@ -20,7 +20,13 @@ pkgs.mkpasswd # for generating password files # Some text editors. - pkgs.vim + (pkgs.vim.customize { + name = "vim"; + vimrcConfig.packages.default = { + start = [ pkgs.vimPlugins.vim-nix ]; + }; + vimrcConfig.customRC = "syntax on"; + }) # Some networking tools. pkgs.fuse From 2e0d7ad9e658e6a233bb22fa6b56625c83f47b08 Mon Sep 17 00:00:00 2001 From: Michael Weiss Date: Sat, 3 Dec 2022 23:58:32 +0100 Subject: [PATCH 3/5] chromium: 108.0.5359.71 -> 108.0.5359.94 https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop.html This update includes 1 security fix. Google is aware that an exploit for CVE-2022-4262 exists in the wild. CVEs: CVE-2022-4262 (cherry picked from commit 66bdeac7cba8444170de02c80818c8f113af6d04) --- .../networking/browsers/chromium/upstream-info.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json index ed437ec93239..064863c27447 100644 --- a/pkgs/applications/networking/browsers/chromium/upstream-info.json +++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json @@ -1,8 +1,8 @@ { "stable": { - "version": "108.0.5359.71", - "sha256": "0pgzf6xrd71is1dld1arhq366vjp8p54x75zyx6y7vcjqj0a0v6b", - "sha256bin64": "0917rpkjs3aybgnv03b47qd8if226cdhv5fwhsv8hlka9wl4kv62", + "version": "108.0.5359.94", + "sha256": "1zmndi4q9x8fyixwl1mp5qyf883x9xafq7ipzf9vk9d8h62521q6", + "sha256bin64": "03s85hf4vxpil27c1kkdicihb42diyyxwfcjji0bq950nl8vpx2d", "deps": { "gn": { "version": "2022-10-05", @@ -13,9 +13,9 @@ }, "chromedriver": { "version": "108.0.5359.71", - "sha256_linux": "12ljm3gnmgqv57p0qnva1zfdvy6cwfvdfjmyk82ziny0i2ylbhsg", - "sha256_darwin": "0c3f7yjmqr2111g87scy138vqxhim36zqgwqwnk22dlrpm92zydm", - "sha256_darwin_aarch64": "1gr0ascnnz3w8nrv2jqb7p7k97577ab9jwb4wdqiliwsjzmbqwbc" + "sha256_linux": "0lxmzmjpy4j5k3hx7wxdbbk87fr883a6323r9fj5nmylb230i3p4", + "sha256_darwin": "14kl58qlxkfq7hipg717nwawzcx7qzg77v322ikgrvqi03f0saci", + "sha256_darwin_aarch64": "08rbp1dqv1xvy1w9jsip3140frbifzblgrn6i9xr612hxysxhap6" } }, "beta": { From 30ebc3783ae74803c4172028114056a6a067b3a4 Mon Sep 17 00:00:00 2001 From: Michael Weiss Date: Sat, 3 Dec 2022 23:58:32 +0100 Subject: [PATCH 4/5] ungoogled-chromium: 108.0.5359.72 -> 108.0.5359.95 (cherry picked from commit d23b4148e703ba826320c65d70dc78504e23aa30) --- .../networking/browsers/chromium/upstream-info.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json index ed437ec93239..a4eae2adc41f 100644 --- a/pkgs/applications/networking/browsers/chromium/upstream-info.json +++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json @@ -45,8 +45,8 @@ } }, "ungoogled-chromium": { - "version": "108.0.5359.72", - "sha256": "1ijvphbmkzha8nbvz17dwypwj1lz7hzr7q9fvk6gma27b1m1d57m", + "version": "108.0.5359.95", + "sha256": "1b3r2yl8qkp8k0kq5yi0a1xsmglniqn3v318fhx0k12cagrgbd5b", "sha256bin64": null, "deps": { "gn": { @@ -56,8 +56,8 @@ "sha256": "1rhadb6qk867jafr85x2m3asis3jv7x06blhmad2d296p26d5w6x" }, "ungoogled-patches": { - "rev": "108.0.5359.72-1", - "sha256": "0gv9566w1q0abam7ngjb0qw7kg2dp43lixm51m9avsvvb6a4wyzz" + "rev": "108.0.5359.95-1", + "sha256": "0fl95hw6ll0g4lrccfxhhnkz3plqm003z09dz8dr6ycx5x3vqk0b" } } } From 332937f2c8303d6a58fd924333d1ff0e5c590e98 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Sun, 4 Dec 2022 11:51:22 +0100 Subject: [PATCH 5/5] element-{web,desktop}: 1.11.14 -> 1.11.15 Backport of 13f3fdd8b3b69f93729459ba2b57d5d58570d8c7 (#204351) to 22.05. ChangeLog web: https://github.com/vector-im/element-web/releases/tag/v1.11.15 ChangeLog desktop: https://github.com/vector-im/element-desktop/releases/tag/v1.11.15 --- .../element/element-desktop-package.json | 18 +++++++++++------- .../instant-messengers/element/pin.json | 8 ++++---- 2 files changed, 15 insertions(+), 11 deletions(-) diff --git a/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json b/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json index 94c31570b401..fda4982fa8a7 100644 --- a/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json +++ b/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json @@ -2,7 +2,7 @@ "name": "element-desktop", "productName": "Element", "main": "lib/electron-main.js", - "version": "1.11.14", + "version": "1.11.15", "description": "A feature-rich client for Matrix.org", "author": "Element", "repository": { @@ -62,22 +62,23 @@ "@types/mkdirp": "^1.0.2", "@types/pacote": "^11.1.1", "@types/rimraf": "^3.0.2", - "@typescript-eslint/eslint-plugin": "^5.6.0", - "@typescript-eslint/parser": "^5.6.0", + "@typescript-eslint/eslint-plugin": "^5.42.0", + "@typescript-eslint/parser": "^5.42.0", "allchange": "^1.0.6", "app-builder-lib": "^22.14.10", "asar": "^2.0.1", "babel-jest": "^28.1.3", "chokidar": "^3.5.2", "detect-libc": "^1.0.3", - "electron": "^20", + "electron": "20.3.4", "electron-builder": "^23.6.0", "electron-builder-squirrel-windows": "^23.6.0", "electron-devtools-installer": "^3.1.1", - "eslint": "7.18.0", + "eslint": "^8.26.0", "eslint-config-google": "^0.14.0", "eslint-plugin-import": "^2.25.4", - "eslint-plugin-matrix-org": "^0.4.0", + "eslint-plugin-matrix-org": "^0.7.0", + "eslint-plugin-unicorn": "^44.0.2", "expect-playwright": "^0.8.0", "find-npm-prefix": "^1.0.2", "fs-extra": "^8.1.0", @@ -121,7 +122,10 @@ "webapp.asar" ], "linux": { - "target": "deb", + "target": [ + "tar.gz", + "deb" + ], "category": "Network;InstantMessaging;Chat", "maintainer": "support@element.io", "desktop": { diff --git a/pkgs/applications/networking/instant-messengers/element/pin.json b/pkgs/applications/networking/instant-messengers/element/pin.json index 61a91630bd53..b0bb59a4d288 100644 --- a/pkgs/applications/networking/instant-messengers/element/pin.json +++ b/pkgs/applications/networking/instant-messengers/element/pin.json @@ -1,6 +1,6 @@ { - "version": "1.11.14", - "desktopSrcHash": "91WCtb+ylVz9gSqOHb5GuSC1YZjDS3M8gdFIZYVls3c=", - "desktopYarnHash": "1ng9fwpwxsw91bzgd2kb2pdq927rkjv5rrrkmszvn55bj6ry7sqi", - "webHash": "06bv2qbbd7zj8987a6ah3bxdnr0qcxrimlns16shk1ciawd0c81d" + "version": "1.11.15", + "desktopSrcHash": "l+IjI3uvnOjaJA6IszDSuOO08SMqbUf8rI/u12g5Rxo=", + "desktopYarnHash": "024vd7xiwialfrag325558qjrqlfxzy9xq7jb15ysawand1k2xyv", + "webHash": "05q60p06y6z82g11nnc5w1rz069cyii64b77zrdag4v6gfap6b1d" }