From 6f282964f246d93a3dcebb2316441f61265fdf32 Mon Sep 17 00:00:00 2001 From: sterni Date: Sat, 12 Sep 2026 12:45:51 +0200 Subject: [PATCH] ocamlPackages.mirage-crypto*: add knownVulnerabilities entries This is a stop gap measure for now since we should be able to fix these issues (i.e. fixes are available and have been released). Unfortunately these fixes are spread across 2.2.0, 2.3.0, 2.4.0 which also contain breaking changes at time. See #562227. These breaking changes require (breaking) updates for at least httpcats and tls. Reference #561924. --- pkgs/development/ocaml-modules/mirage-crypto/default.nix | 3 +++ pkgs/development/ocaml-modules/mirage-crypto/ec.nix | 5 +++++ pkgs/development/ocaml-modules/mirage-crypto/pk.nix | 3 +++ 3 files changed, 11 insertions(+) diff --git a/pkgs/development/ocaml-modules/mirage-crypto/default.nix b/pkgs/development/ocaml-modules/mirage-crypto/default.nix index 2dea0eb4c218..16854c5d9e5e 100644 --- a/pkgs/development/ocaml-modules/mirage-crypto/default.nix +++ b/pkgs/development/ocaml-modules/mirage-crypto/default.nix @@ -43,5 +43,8 @@ buildDunePackage (finalAttrs: { sternenseemann momeemt ]; + knownVulnerabilities = [ + "CVE-2026-87732" # fixed in 2.2.0 + ]; }; }) diff --git a/pkgs/development/ocaml-modules/mirage-crypto/ec.nix b/pkgs/development/ocaml-modules/mirage-crypto/ec.nix index 6699de8e39cc..accc17fc198a 100644 --- a/pkgs/development/ocaml-modules/mirage-crypto/ec.nix +++ b/pkgs/development/ocaml-modules/mirage-crypto/ec.nix @@ -43,5 +43,10 @@ buildDunePackage { meta = mirage-crypto.meta // { description = "Elliptic Curve Cryptography with primitives taken from Fiat"; + knownVulnerabilities = [ + "CVE-2026-87733" # fixed in 2.2.0 + "CVE-2026-87736" # fixed in 2.3.0 + "CVE-2026-87737" # fixed in 2.4.0 + ]; }; } diff --git a/pkgs/development/ocaml-modules/mirage-crypto/pk.nix b/pkgs/development/ocaml-modules/mirage-crypto/pk.nix index 6700008e7a97..668cb95e74d4 100644 --- a/pkgs/development/ocaml-modules/mirage-crypto/pk.nix +++ b/pkgs/development/ocaml-modules/mirage-crypto/pk.nix @@ -30,5 +30,8 @@ buildDunePackage { meta = mirage-crypto.meta // { description = "Simple public-key cryptography for the modern age"; + knownVulnerabilities = [ + "CVE-2026-87735" # fixed in 2.3.0 + ]; }; }