From bdd4c549c634da127fea6648a4ee97e46e1dca1b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9-Patrick=20Bubel?= Date: Sun, 26 Dec 2021 19:00:06 +0100 Subject: [PATCH 1/4] mediathekview: CVE-2021-45105 (log4j) mitigation Remove the affected JndiLookup.class until we can update to the lastest Mediathekview version. (cherry picked from commit 2a360652e2af41c7afdc4d15b96e187417aebb04) --- pkgs/applications/video/mediathekview/default.nix | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/video/mediathekview/default.nix b/pkgs/applications/video/mediathekview/default.nix index 2005a949a5c4..90ce4f5b4378 100644 --- a/pkgs/applications/video/mediathekview/default.nix +++ b/pkgs/applications/video/mediathekview/default.nix @@ -1,4 +1,4 @@ -{ lib, stdenv, fetchurl, makeWrapper, jre }: +{ lib, stdenv, fetchurl, makeWrapper, jre, zip }: stdenv.mkDerivation rec { version = "13.7.1"; @@ -8,11 +8,14 @@ stdenv.mkDerivation rec { sha256 = "sha256-yFPyj1Mbgj2eJv4DpvfOtPyTbL9gMAXC5TzSx8AV27o="; }; - nativeBuildInputs = [ makeWrapper ]; + nativeBuildInputs = [ makeWrapper zip ]; installPhase = '' mkdir -p $out/{bin,lib} + # log4j mitigation, see https://logging.apache.org/log4j/2.x/security.html + zip -d MediathekView.jar org/apache/logging/log4j/core/lookup/JndiLookup.class + install -m644 MediathekView.jar $out/lib makeWrapper ${jre}/bin/java $out/bin/mediathek \ From 8730eba0ff9501a347d4924fad844f50586802b3 Mon Sep 17 00:00:00 2001 From: Robert Scott Date: Tue, 28 Dec 2021 15:02:57 +0000 Subject: [PATCH 2/4] gegl_0_4: add patch for CVE-2021-45463 --- pkgs/development/libraries/gegl/4.0.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/pkgs/development/libraries/gegl/4.0.nix b/pkgs/development/libraries/gegl/4.0.nix index 11f4f070c08f..736494f9c17c 100644 --- a/pkgs/development/libraries/gegl/4.0.nix +++ b/pkgs/development/libraries/gegl/4.0.nix @@ -1,6 +1,7 @@ { lib , stdenv , fetchurl +, fetchpatch , pkg-config , vala , gobject-introspection @@ -46,6 +47,14 @@ stdenv.mkDerivation rec { sha256 = "sha256-wRJ4LPQJaWniMhfM36vkIoTjXVQ1/wxD1A5McPrsqN0="; }; + patches = [ + (fetchpatch { + name = "CVE-2021-45463.patch"; + url = "https://gitlab.gnome.org/GNOME/gegl/-/commit/bfce470f0f2f37968862129d5038b35429f2909b.patch"; + sha256 = "0nvgn7hfw6pia19xqp51mkp9nh730v19ha050dz0algnrk3ngakp"; + }) + ]; + nativeBuildInputs = [ pkg-config gettext From 46050f5dd7d3211b3985a795bdcee50754317ee8 Mon Sep 17 00:00:00 2001 From: Robert Scott Date: Fri, 31 Dec 2021 22:09:12 +0000 Subject: [PATCH 3/4] unicorn: add patch for CVE-2021-44078 --- .../libraries/unicorn/1.0.2-CVE-2021-44078.patch | 15 +++++++++++++++ pkgs/development/libraries/unicorn/default.nix | 2 ++ 2 files changed, 17 insertions(+) create mode 100644 pkgs/development/libraries/unicorn/1.0.2-CVE-2021-44078.patch diff --git a/pkgs/development/libraries/unicorn/1.0.2-CVE-2021-44078.patch b/pkgs/development/libraries/unicorn/1.0.2-CVE-2021-44078.patch new file mode 100644 index 000000000000..03836cfc51d7 --- /dev/null +++ b/pkgs/development/libraries/unicorn/1.0.2-CVE-2021-44078.patch @@ -0,0 +1,15 @@ +Based on upstream https://github.com/unicorn-engine/unicorn/commit/c733bbada356b0373fa8aa72c044574bb855fd24.patch +adapted by ris to apply to 1.0.2 + +--- a/uc.c ++++ b/uc.c +@@ -864,7 +864,8 @@ static bool split_region(struct uc_struct *uc, MemoryRegion *mr, + break; + + QTAILQ_FOREACH(block, &uc->ram_list.blocks, next) { +- if (block->offset <= mr->addr && block->length >= (mr->end - mr->addr)) { ++ // block->offset is the offset within ram_addr_t, not GPA ++ if (block->mr->addr <= mr->addr && block->length >= (mr->end - mr->addr)) { + break; + } + diff --git a/pkgs/development/libraries/unicorn/default.nix b/pkgs/development/libraries/unicorn/default.nix index 7f768d9631bb..c92688b9fd8a 100644 --- a/pkgs/development/libraries/unicorn/default.nix +++ b/pkgs/development/libraries/unicorn/default.nix @@ -15,6 +15,8 @@ stdenv.mkDerivation rec { sha256 = "0jgnyaq6ykpbg5hrwc0p3pargmr9hpzqfsj6ymp4k07pxnqal76j"; }; + patches = [ ./1.0.2-CVE-2021-44078.patch ]; + nativeBuildInputs = [ pkg-config cmake ]; meta = with lib; { From 6db08005e382b294343bc4772636d1e520217125 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Wed, 17 Nov 2021 13:26:02 +0100 Subject: [PATCH 4/4] hyperscan: fix build (cherry picked from commit 76c1bb81060673f9c2e6991a95f85aa0840758e3) --- pkgs/development/libraries/hyperscan/default.nix | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/pkgs/development/libraries/hyperscan/default.nix b/pkgs/development/libraries/hyperscan/default.nix index 4093578156a6..10a53ff1d98f 100644 --- a/pkgs/development/libraries/hyperscan/default.nix +++ b/pkgs/development/libraries/hyperscan/default.nix @@ -1,5 +1,5 @@ { lib, stdenv, fetchFromGitHub, cmake, ragel, python3 -, coreutils, gnused, util-linux +, coreutils, gnused, util-linux, fetchpatch , boost , withStatic ? false # build only shared libs by default, build static+shared if true }: @@ -37,6 +37,14 @@ stdenv.mkDerivation rec { ++ lib.optional (withStatic) "-DBUILD_STATIC_AND_SHARED=ON" ++ lib.optional (!withStatic) "-DBUILD_SHARED_LIBS=ON"; + patches = [ + (fetchpatch { + # part of https://github.com/intel/hyperscan/pull/336 + url = "https://github.com/intel/hyperscan/commit/e2c4010b1fc1272cab816ba543940b3586e68a0c.patch"; + sha256 = "sha256-doVNwROL6MTcgOW8jBwGTnxe0zvxjawiob/g6AvXLak="; + }) + ]; + postPatch = '' sed -i '/examples/d' CMakeLists.txt substituteInPlace libhs.pc.in \