From 0d64b49371432e237c43b0286f644817c8f24874 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 15 Jul 2022 07:56:46 +0000 Subject: [PATCH 1/9] ptcollab: 0.6.1.0 -> 0.6.1.1 (cherry picked from commit 419b730533581305692bd8b244035fd46917b6f6) --- pkgs/applications/audio/ptcollab/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/audio/ptcollab/default.nix b/pkgs/applications/audio/ptcollab/default.nix index e7e8c73c9c1b..b2faf62b0fe0 100644 --- a/pkgs/applications/audio/ptcollab/default.nix +++ b/pkgs/applications/audio/ptcollab/default.nix @@ -13,13 +13,13 @@ mkDerivation rec { pname = "ptcollab"; - version = "0.6.1.0"; + version = "0.6.1.1"; src = fetchFromGitHub { owner = "yuxshao"; repo = "ptcollab"; rev = "v${version}"; - sha256 = "sha256-zkDMZT1kKCLqNvvxZFKVuXFqZptX/LG/R9kRUcNJphw="; + sha256 = "sha256-ydn3qKOK0GwA/mBPbGwSIac09b9cz6YOFbuDFFV8jJs="; }; nativeBuildInputs = [ qmake pkg-config ]; From 103c8bad7b187e59d84e5d68ade5f713ceb65bdf Mon Sep 17 00:00:00 2001 From: kilianar Date: Thu, 21 Jul 2022 06:36:18 +0200 Subject: [PATCH 2/9] minio: 2022-05-08T23-50-31Z -> 2022-07-17T15-43-14Z https://github.com/minio/minio/releases/tag/RELEASE.2022-07-17T15-43-14Z fixes CVE-2022-31028 (cherry picked from commit 4bf0af2efdba7a8d9e524a86af99d1a457ffe09e) --- pkgs/servers/minio/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix index 3349f0cf3a02..b4f876b30578 100644 --- a/pkgs/servers/minio/default.nix +++ b/pkgs/servers/minio/default.nix @@ -15,16 +15,16 @@ let in buildGoModule rec { pname = "minio"; - version = "2022-05-08T23-50-31Z"; + version = "2022-07-17T15-43-14Z"; src = fetchFromGitHub { owner = "minio"; repo = "minio"; rev = "RELEASE.${version}"; - sha256 = "sha256-Ssuqk/ax6MWdXtbJqWeTTtsIiTK4FmYSR5rOqxh+IaU="; + sha256 = "sha256-hQ52fL4Z3RHthHaJXCkKpbebWpq8MxHo4BziokTuJA4="; }; - vendorSha256 = "sha256-JoI3B3rDzlY0lDHF3rjrzv8/Rq+XCFRs35bWVZqfAKA="; + vendorSha256 = "sha256-u36oHqIxMD3HRio9A3tUt6FO1DtAcQDiC/O54ByeNyg="; doCheck = false; From b3f0680e945f9b59ac76dbd430976fac8d6eeb80 Mon Sep 17 00:00:00 2001 From: Robert Scott Date: Fri, 22 Jul 2022 23:44:04 +0100 Subject: [PATCH 3/9] mediawiki: 1.37.2 -> 1.37.4 --- pkgs/servers/web-apps/mediawiki/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/web-apps/mediawiki/default.nix b/pkgs/servers/web-apps/mediawiki/default.nix index 2339c170f166..190450dc7540 100644 --- a/pkgs/servers/web-apps/mediawiki/default.nix +++ b/pkgs/servers/web-apps/mediawiki/default.nix @@ -2,11 +2,11 @@ stdenv.mkDerivation rec { pname = "mediawiki"; - version = "1.37.2"; + version = "1.37.4"; src = with lib; fetchurl { url = "https://releases.wikimedia.org/mediawiki/${versions.majorMinor version}/${pname}-${version}.tar.gz"; - sha256 = "sha256-WD8HS8r87BfaUBQqVvW7/eXDNml31h2RLX5W/Mo72hs="; + sha256 = "sha256-oBLDWSCiH90l/34ScW3qQU2KTxvrbG/OqAfS9uWQ42Q="; }; prePatch = '' From 00cd208c40c95b50639d5500e5e7e042dd0811e3 Mon Sep 17 00:00:00 2001 From: Peder Bergebakken Sundt Date: Sat, 23 Jul 2022 05:45:24 +0200 Subject: [PATCH 4/9] rainloop-{community,standard}: patch CVE-2022-29360 (cherry picked from commit d23282a2f559ff4860e2b58e210cc7779c65d1ee) --- pkgs/servers/rainloop/default.nix | 18 ++++++++++++--- .../servers/rainloop/fix-cve-2022-29360.patch | 23 +++++++++++++++++++ 2 files changed, 38 insertions(+), 3 deletions(-) create mode 100644 pkgs/servers/rainloop/fix-cve-2022-29360.patch diff --git a/pkgs/servers/rainloop/default.nix b/pkgs/servers/rainloop/default.nix index bc1f0905c6b8..1c7c76b2bd43 100644 --- a/pkgs/servers/rainloop/default.nix +++ b/pkgs/servers/rainloop/default.nix @@ -1,10 +1,10 @@ -{ lib, stdenv, fetchurl, unzip, pkgs, dataPath ? "/var/lib/rainloop" }: let +{ lib, stdenv, fetchurl, unzip, writeText, dos2unix, dataPath ? "/var/lib/rainloop" }: let common = { edition, sha256 }: stdenv.mkDerivation (rec { pname = "rainloop${lib.optionalString (edition != "") "-${edition}"}"; version = "1.16.0"; - nativeBuildInputs = [ unzip ]; + nativeBuildInputs = [ unzip dos2unix ]; unpackPhase = '' mkdir rainloop @@ -16,7 +16,19 @@ sha256 = sha256; }; - includeScript = pkgs.writeText "include.php" '' + prePatch = '' + dos2unix ./rainloop/rainloop/v/1.16.0/app/libraries/MailSo/Base/HtmlUtils.php + ''; + + patches = [ + ./fix-cve-2022-29360.patch + ]; + + postPatch = '' + unix2dos ./rainloop/rainloop/v/1.16.0/app/libraries/MailSo/Base/HtmlUtils.php + ''; + + includeScript = writeText "include.php" '' setAttribute($sKey, $sValue); + } + +- $oWrapDom = $oDom->createElement('div', '___xxx___'); ++ $rand_str = base64_encode(random_bytes(32)); ++ $oWrapDom = $oDom->createElement('div', $rand_str); + $oWrapDom->setAttribute('data-x-div-type', 'body'); + foreach ($aBodylAttrs as $sKey => $sValue) + { +@@ -250,7 +251,7 @@ class HtmlUtils + + $sWrp = $oDom->saveHTML($oWrapHtml); + +- $sResult = \str_replace('___xxx___', $sResult, $sWrp); ++ $sResult = \str_replace($rand_str, $sResult, $sWrp); + } + + $sResult = \str_replace(\MailSo\Base\HtmlUtils::$KOS, ':', $sResult); From b841640f23cbb7e47f6cb37b384a2e3b3fcd0fd8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B8rn=20Forsman?= Date: Sat, 23 Jul 2022 13:57:25 +0200 Subject: [PATCH 5/9] nixos/syncthing: don't leak the secret API key in process listings (cherry picked from commit 65399c47424c7b33d90c6a3b581b38ed2f66b859) --- nixos/modules/services/networking/syncthing.nix | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix index 3a3d4c80ecff..9411c8753301 100644 --- a/nixos/modules/services/networking/syncthing.nix +++ b/nixos/modules/services/networking/syncthing.nix @@ -30,15 +30,22 @@ let updateConfig = pkgs.writers.writeDash "merge-syncthing-config" '' set -efu + # be careful not to leak secrets in the filesystem or in process listings + + umask 0077 + # get the api key by parsing the config.xml while - ! api_key=$(${pkgs.libxml2}/bin/xmllint \ + ! ${pkgs.libxml2}/bin/xmllint \ --xpath 'string(configuration/gui/apikey)' \ - ${cfg.configDir}/config.xml) + ${cfg.configDir}/config.xml \ + >"$RUNTIME_DIRECTORY/api_key" do sleep 1; done + (printf "X-API-Key: "; cat "$RUNTIME_DIRECTORY/api_key") >"$RUNTIME_DIRECTORY/headers" + curl() { - ${pkgs.curl}/bin/curl -sSLk -H "X-API-Key: $api_key" \ + ${pkgs.curl}/bin/curl -sSLk -H "@$RUNTIME_DIRECTORY/headers" \ --retry 1000 --retry-delay 1 --retry-all-errors \ "$@" } @@ -588,6 +595,7 @@ in { serviceConfig = { User = cfg.user; RemainAfterExit = true; + RuntimeDirectory = "syncthing-init"; Type = "oneshot"; ExecStart = updateConfig; }; From 406170dc078546210dd99e72c9880d47391c4061 Mon Sep 17 00:00:00 2001 From: Minijackson Date: Sat, 23 Jul 2022 15:26:13 +0200 Subject: [PATCH 6/9] carla: 2.4.3 -> 2.5.0 (cherry picked from commit 69036df904c92bdd73bf3e689956dcbcdd02045c) --- pkgs/applications/audio/carla/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/audio/carla/default.nix b/pkgs/applications/audio/carla/default.nix index 9e4e6a2880d0..291c3875cea8 100644 --- a/pkgs/applications/audio/carla/default.nix +++ b/pkgs/applications/audio/carla/default.nix @@ -15,13 +15,13 @@ assert withGtk3 -> gtk3 != null; stdenv.mkDerivation rec { pname = "carla"; - version = "2.4.3"; + version = "2.5.0"; src = fetchFromGitHub { owner = "falkTX"; repo = pname; rev = "v${version}"; - sha256 = "sha256-FAQTIM5NpcOhLNMf62qiKaxg6QtK5uIJF/XT6KJVnUc="; + sha256 = "sha256-KcwEuiy58wjTr+RWPmpMaPgM0olzxiWp9MMYiKwmIcI="; }; nativeBuildInputs = [ From 4cdcc3e2add33299d3a9519902893035fbe2de2a Mon Sep 17 00:00:00 2001 From: OPNA2608 Date: Sat, 23 Jul 2022 17:57:04 +0200 Subject: [PATCH 7/9] bambootracker: 0.5.0 -> 0.5.1 (cherry picked from commit 0beea3a05a520799e01bfb523279efbb5681bbb2) --- pkgs/applications/audio/bambootracker/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/audio/bambootracker/default.nix b/pkgs/applications/audio/bambootracker/default.nix index b2cce97bbc46..7408f57a1a98 100644 --- a/pkgs/applications/audio/bambootracker/default.nix +++ b/pkgs/applications/audio/bambootracker/default.nix @@ -12,14 +12,14 @@ mkDerivation rec { pname = "bambootracker"; - version = "0.5.0"; + version = "0.5.1"; src = fetchFromGitHub { owner = "BambooTracker"; repo = "BambooTracker"; rev = "v${version}"; fetchSubmodules = true; - sha256 = "1mpbvhsmrn0wdmxfp3n5dwv4474qlhy47r3vwc2jwdslq6vgl1fa"; + sha256 = "sha256-AEELUJYiapF/sBWRXXuBXUHwnKp0szdIOCNVMYufv94="; }; nativeBuildInputs = [ qmake qttools pkg-config ]; From 254afed787c4081adaba6139ba3866656cd4551e Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 25 Apr 2022 12:44:27 +0000 Subject: [PATCH 8/9] grails: 5.1.6 -> 5.1.7 (cherry picked from commit 675d89b8bccbdd2b6a52ef8742fa0a6f27748993) --- pkgs/development/web/grails/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/web/grails/default.nix b/pkgs/development/web/grails/default.nix index c300062c5235..2497956b9182 100644 --- a/pkgs/development/web/grails/default.nix +++ b/pkgs/development/web/grails/default.nix @@ -11,11 +11,11 @@ let in stdenv.mkDerivation rec { pname = "grails"; - version = "5.1.6"; + version = "5.1.7"; src = fetchurl { url = "https://github.com/grails/grails-core/releases/download/v${version}/grails-${version}.zip"; - sha256 = "sha256-H4c/Nu6iOgaRLl/uV51nYnNQg5p9cjl/taexZnl4t+I="; + sha256 = "sha256-Sk+VvuEyzZ9sSeI9fOuHgmgSu89WjriiK/6UU/eWqag="; }; nativeBuildInputs = [ unzip ]; From 99c46c5bb5ab0e74a94945fe9222132757667d17 Mon Sep 17 00:00:00 2001 From: Robert Scott Date: Sat, 23 Jul 2022 18:27:45 +0100 Subject: [PATCH 9/9] grails: 5.1.7 -> 5.1.9 addressing CVE-2022-35912 https://nvd.nist.gov/vuln/detail/CVE-2022-35912 (cherry picked from commit 10e96b76b3a896291016aa55240c63b0a6122495) --- pkgs/development/web/grails/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/web/grails/default.nix b/pkgs/development/web/grails/default.nix index 2497956b9182..c1ab63b132aa 100644 --- a/pkgs/development/web/grails/default.nix +++ b/pkgs/development/web/grails/default.nix @@ -11,11 +11,11 @@ let in stdenv.mkDerivation rec { pname = "grails"; - version = "5.1.7"; + version = "5.1.9"; src = fetchurl { url = "https://github.com/grails/grails-core/releases/download/v${version}/grails-${version}.zip"; - sha256 = "sha256-Sk+VvuEyzZ9sSeI9fOuHgmgSu89WjriiK/6UU/eWqag="; + sha256 = "sha256-gOC1jwFoasxTAhXoX/Mbl5uL1p6NjXcjpz7td8DZUlk="; }; nativeBuildInputs = [ unzip ];