From 408c3e3049917c365633e02b3421f39cf7265bdb Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Mon, 1 Aug 2022 17:22:05 +0200
Subject: [PATCH 1/2] unbound: fix CVE-2022-30698 and CVE-2022-30699

---
 pkgs/tools/networking/unbound/default.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index b92fb23d64e5..feb3298c5ba7 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, fetchpatch
 , openssl
 , nettle
 , expat
@@ -107,6 +108,16 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  patches = [
+    # Fix CVE-2022-30698 and CVE-2022-30699
+    (fetchpatch {
+      url = "https://github.com/NLnetLabs/unbound/commit/f6753a0f1018133df552347a199e0362fc1dac68.patch";
+      name = "CVE-2022-30698.CVE-2022-30699.patch";
+      hash = "sha256-tLHkQoAbtYqLr3ASYfYX6pGtjD2TWT4B5NUubT4EN90=";
+      excludes = [ "doc/Changelog" ];
+    })
+  ];
+
   postPatch = lib.optionalString withPythonModule ''
     substituteInPlace Makefile.in \
       --replace "\$(DESTDIR)\$(PYTHON_SITE_PKG)" "$out/${python.sitePackages}"

From 5e718d78c1d2a35b22c7e831d88e6d1ff1b5bbd1 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Tue, 2 Aug 2022 00:10:38 +0200
Subject: [PATCH 2/2] python3.pkgs.pyunbound: inherit patches from unbound

---
 pkgs/tools/networking/unbound/python.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/tools/networking/unbound/python.nix b/pkgs/tools/networking/unbound/python.nix
index 067f5d2b417b..8acd6ff04417 100644
--- a/pkgs/tools/networking/unbound/python.nix
+++ b/pkgs/tools/networking/unbound/python.nix
@@ -5,7 +5,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "pyunbound";
-  inherit (unbound) version src;
+  inherit (unbound) version src patches;
 
   nativeBuildInputs = [ swig ];