From d34bd5b51f63fa9ebd0c01ab2d1362b00fdd92be Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Mon, 22 Apr 2024 19:36:31 +0200 Subject: [PATCH] vault, vault-bin: add CVE-2024-2660 to the knownVulnerabilities Ideally we would upgrade but in this specific instance the fixed versions (and the patch for the issue) have been relicensed under the Business Source License which is unfree. Tagging the packages with `knownVulnerabilities` seems to be our least worse solution. If someone care enough I'm guessing the unfree versions could be backported under a different names in 23.11. --- pkgs/tools/security/vault/default.nix | 1 + pkgs/tools/security/vault/vault-bin.nix | 1 + 2 files changed, 2 insertions(+) diff --git a/pkgs/tools/security/vault/default.nix b/pkgs/tools/security/vault/default.nix index bb7fdfa0fc27..3c798692ef8e 100644 --- a/pkgs/tools/security/vault/default.nix +++ b/pkgs/tools/security/vault/default.nix @@ -49,5 +49,6 @@ buildGoModule rec { license = licenses.mpl20; mainProgram = "vault"; maintainers = with maintainers; [ rushmorem lnl7 offline pradeepchhetri Chili-Man techknowlogick ]; + knownVulnerabilities = [ "CVE-2024-2660" ]; }; } diff --git a/pkgs/tools/security/vault/vault-bin.nix b/pkgs/tools/security/vault/vault-bin.nix index 8644949bf68b..f1d0c0ec43ee 100644 --- a/pkgs/tools/security/vault/vault-bin.nix +++ b/pkgs/tools/security/vault/vault-bin.nix @@ -59,5 +59,6 @@ stdenv.mkDerivation rec { maintainers = with maintainers; teams.serokell.members ++ [ offline psyanticy Chili-Man techknowlogick mkaito ]; mainProgram = "vault"; platforms = [ "x86_64-linux" "i686-linux" "x86_64-darwin" "aarch64-darwin" "aarch64-linux" ]; + knownVulnerabilities = [ "CVE-2024-2660" ]; }; }