From dc0b71be6bc0b9827f97f5f7a4bdd9b3d068a8f8 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 20 Dec 2022 23:37:46 +0100 Subject: [PATCH 1/2] openvswitch: 2.17.0 -> 2.17.5 Fixes LLDP underflow issue while parsing malformed Auto Attach TLVs. https://www.openvswitch.org/releases/NEWS-2.17.1.txt https://www.openvswitch.org/releases/NEWS-2.17.2.txt https://www.openvswitch.org/releases/NEWS-2.17.3.txt https://www.openvswitch.org/releases/NEWS-2.17.4.txt https://www.openvswitch.org/releases/NEWS-2.17.5.txt --- pkgs/os-specific/linux/openvswitch/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/openvswitch/default.nix b/pkgs/os-specific/linux/openvswitch/default.nix index ba93b068fddc..5f4f0dd5c35d 100644 --- a/pkgs/os-specific/linux/openvswitch/default.nix +++ b/pkgs/os-specific/linux/openvswitch/default.nix @@ -8,12 +8,12 @@ let _kernel = kernel; pythonEnv = python3.withPackages (ps: with ps; [ six ]); in stdenv.mkDerivation rec { - version = "2.17.0"; + version = "2.17.5"; pname = "openvswitch"; src = fetchurl { url = "https://www.openvswitch.org/releases/${pname}-${version}.tar.gz"; - sha256 = "sha256-4Dv6t8qC2Bp9OjbeTzkKO1IQ4/OWV2cfkih3zU6m3HM="; + sha256 = "sha256-Woye+zUikjdGWIp8pRDBC7CsUrnInfJ23byGcxFtwQY="; }; kernel = optional (_kernel != null) _kernel.dev; From d0b452290c9d2127db2f9b59bc441554040b4fba Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 20 Dec 2022 23:41:33 +0100 Subject: [PATCH 2/2] openvswitch-lts: Mark known vulnerable https://www.openwall.com/lists/oss-security/2022/12/20/2 --- pkgs/os-specific/linux/openvswitch/lts.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/os-specific/linux/openvswitch/lts.nix b/pkgs/os-specific/linux/openvswitch/lts.nix index 15c6c05b0613..f9842cff0361 100644 --- a/pkgs/os-specific/linux/openvswitch/lts.nix +++ b/pkgs/os-specific/linux/openvswitch/lts.nix @@ -77,5 +77,8 @@ in stdenv.mkDerivation rec { homepage = "https://www.openvswitch.org/"; license = licenses.asl20; maintainers = with maintainers; [ netixx kmcopper ]; + knownVulnerabilities = [ + "LLDP undervflow while parsing malformed Auto Attach TLV, see https://www.openwall.com/lists/oss-security/2022/12/20/2." + ]; }; }