From 9cc8d4234e85785ed0d67967716df691a0f1e262 Mon Sep 17 00:00:00 2001 From: Michael Weiss Date: Wed, 11 May 2022 12:54:13 +0200 Subject: [PATCH 1/4] chromium: 101.0.4951.54 -> 101.0.4951.64 https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html This update includes 13 security fixes. CVEs: CVE-2022-1633 CVE-2022-1634 CVE-2022-1635 CVE-2022-1636 CVE-2022-1637 CVE-2022-1638 CVE-2022-1639 CVE-2022-1640 CVE-2022-1641 (cherry picked from commit 9a0ff61993e02bb9db5860d383866dc7537de148) --- .../networking/browsers/chromium/upstream-info.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json index 2fa52af9e0d2..d5a67ea09bdf 100644 --- a/pkgs/applications/networking/browsers/chromium/upstream-info.json +++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json @@ -1,8 +1,8 @@ { "stable": { - "version": "101.0.4951.54", - "sha256": "1d808a7mvg0nd0mm20c1ny5kdvb2xvrs8vz4nnk456ix8pywcv62", - "sha256bin64": "1m6s6xf2wvz535w6jskk3pnibvsjpzmbxvd9rlxmqr08y219gp5y", + "version": "101.0.4951.64", + "sha256": "1xyqm32y9v1hn8ji6qfw6maynqgg3266j58dq4x4aqsm2gj9cn4w", + "sha256bin64": "14ijrj7h2y72ppyysz6jv40c01lbnan7z69cl24asch2zjlgwv8v", "deps": { "gn": { "version": "2022-03-14", From d828170ab14683774c321070a08e53ca0d870fd2 Mon Sep 17 00:00:00 2001 From: Linus Heckemann Date: Thu, 12 May 2022 14:55:28 +0200 Subject: [PATCH 2/4] runc: fix CVE-2022-29162 https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66 Fixes: CVE-2022-29162 --- pkgs/applications/virtualization/runc/default.nix | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/pkgs/applications/virtualization/runc/default.nix b/pkgs/applications/virtualization/runc/default.nix index 79a21075f038..2141de011ac7 100644 --- a/pkgs/applications/virtualization/runc/default.nix +++ b/pkgs/applications/virtualization/runc/default.nix @@ -12,6 +12,7 @@ , makeWrapper , procps , nixosTests +, fetchpatch }: buildGoModule rec { @@ -28,6 +29,15 @@ buildGoModule rec { vendorSha256 = null; outputs = [ "out" "man" ]; + patches = [ + (fetchpatch { + # https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66 + name = "CVE-2022-29162.patch"; + url = "https://github.com/opencontainers/runc/commit/364ec0f1b4fa188ad96049c590ecb42fa70ea165.patch"; + sha256 = "sha256-NXnM3XO+rMXIC57Gh9ovOxkfXCTsuv9MAXi2CajFurs="; + }) + ]; + nativeBuildInputs = [ go-md2man installShellFiles makeWrapper pkg-config which ]; buildInputs = [ libselinux libseccomp libapparmor ]; From e705410c762081d28b8a9ad4ccf53699acd18df6 Mon Sep 17 00:00:00 2001 From: Michael Weiss Date: Wed, 11 May 2022 21:45:36 +0200 Subject: [PATCH 3/4] ungoogled-chromium: 101.0.4951.54 -> 101.0.4951.64 (cherry picked from commit a0f35c34e186e3c63b5de560135598840358f090) --- .../networking/browsers/chromium/upstream-info.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json index d5a67ea09bdf..1c059346aafe 100644 --- a/pkgs/applications/networking/browsers/chromium/upstream-info.json +++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json @@ -45,9 +45,9 @@ } }, "ungoogled-chromium": { - "version": "101.0.4951.54", - "sha256": "1d808a7mvg0nd0mm20c1ny5kdvb2xvrs8vz4nnk456ix8pywcv62", - "sha256bin64": "1m6s6xf2wvz535w6jskk3pnibvsjpzmbxvd9rlxmqr08y219gp5y", + "version": "101.0.4951.64", + "sha256": "1xyqm32y9v1hn8ji6qfw6maynqgg3266j58dq4x4aqsm2gj9cn4w", + "sha256bin64": "14ijrj7h2y72ppyysz6jv40c01lbnan7z69cl24asch2zjlgwv8v", "deps": { "gn": { "version": "2022-03-14", @@ -56,8 +56,8 @@ "sha256": "0nql15ckjqkm001xajq3qyn4h4q80i7x6dm9zinxxr1a8q5lppx3" }, "ungoogled-patches": { - "rev": "101.0.4951.54-1", - "sha256": "0zhzy7llqddvym992pwhkgqh2f6ywjqqg0bhahl6c0np95gzhpbs" + "rev": "101.0.4951.64-1", + "sha256": "0k7w6xvjf1yzyak9ywvcdw762d8zbx6d8haz35q87jz0mxfn2mr3" } } } From 000134d061db62d0b1d7f7691d449417534ae78c Mon Sep 17 00:00:00 2001 From: Louis Bettens Date: Wed, 11 May 2022 23:30:58 +0200 Subject: [PATCH 4/4] brave: 1.38.111 -> 1.38.115 (cherry picked from commit 47ff7333f493324e8b0e91ac1e15342845ba630f) --- pkgs/applications/networking/browsers/brave/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix index cf2c8d4dfe63..5cbee9df7d72 100644 --- a/pkgs/applications/networking/browsers/brave/default.nix +++ b/pkgs/applications/networking/browsers/brave/default.nix @@ -93,11 +93,11 @@ in stdenv.mkDerivation rec { pname = "brave"; - version = "1.38.111"; + version = "1.38.115"; src = fetchurl { url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb"; - sha256 = "sha256-sUTQktCQOVyXbw58u9ilFZaKg6D24Okpa+rUIO56ors="; + sha256 = "sha256-YQpFsB3VVzsOa7PoZ+TLv10Dzm9z819cmyw7atnG/Cs="; }; dontConfigure = true;