From fcf46ce73ded4573cc6692aa1056477232601f20 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Sat, 13 Nov 2021 13:52:19 +0100 Subject: [PATCH] roundcube: 1.4.11 -> 1.4.12 ChangeLog: https://github.com/roundcube/roundcubemail/releases/tag/1.4.12 This fixes a XSS[1] and a SQL-injection[2] vulnerability. Both are already fixed on 1.5.0 which is available on `nixos-unstable`[3]. [1] https://github.com/roundcube/roundcubemail/pull/8193 [2] https://github.com/roundcube/roundcubemail/commit/4e1358b4dc1a8116357657ae5c8738e855aea85a [3] https://nixpk.gs/pr-tracker.html?pr=142148 --- pkgs/servers/roundcube/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/roundcube/default.nix b/pkgs/servers/roundcube/default.nix index 75afedaa2ddc..58f5458a0fd1 100644 --- a/pkgs/servers/roundcube/default.nix +++ b/pkgs/servers/roundcube/default.nix @@ -2,11 +2,11 @@ stdenv.mkDerivation rec { pname = "roundcube"; - version = "1.4.11"; + version = "1.4.12"; src = fetchurl { url = "https://github.com/roundcube/roundcubemail/releases/download/${version}/roundcubemail-${version}-complete.tar.gz"; - sha256 = "sha256-rHMZBwwwX8LIjHcjYFVi2GBwMHMr7ukxzbQJHPBeabc="; + sha256 = "sha256-FbBBGuyVd1BnKeT+KpEGvffFHw3c3qeZRaSWh5Wr0ro="; }; patches = [ ./0001-Don-t-resolve-symlinks-when-trying-to-find-INSTALL_P.patch ];