diff options
| author | ajs124 <git@ajs124.de> | 2022-10-11 16:53:28 +0200 |
|---|---|---|
| committer | ajs124 <git@ajs124.de> | 2022-10-12 11:41:02 +0200 |
| commit | 9461ea4c57a7521e6ea2dd716170a1537433d371 (patch) | |
| tree | 9396758d5701e1b1b8f137875f0eb84b34c02436 | |
| parent | Merge pull request #195574 from NixOS/backport-195557-to-release-22.05 (diff) | |
| download | nixpkgs-origin/backport-195537-to-release-22.05.tar.gz | |
openssl: 3.0.5 -> 3.0.6origin/backport-195537-to-release-22.05
fixes CVE-2022-3358
https://www.openssl.org/news/secadv/20221011.txt
(cherry picked from commit 0c743ca36f22e962e9b7ab85cc10b1339c0a3e1a)
| -rw-r--r-- | pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch | 33 | ||||
| -rw-r--r-- | pkgs/development/libraries/openssl/default.nix | 4 |
2 files changed, 20 insertions, 17 deletions
diff --git a/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch b/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch index baf162e88d09..04585565a331 100644 --- a/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch +++ b/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch @@ -1,22 +1,25 @@ diff --git a/Configure b/Configure -index f0ad787bc4..a48d2008c6 100755 +index a558e5ab1a..9a884f0b0f 100755 --- a/Configure +++ b/Configure -@@ -1688,17 +1688,6 @@ unless ($disabled{devcryptoeng}) { +@@ -1714,20 +1714,6 @@ unless ($disabled{devcryptoeng}) { + unless ($disabled{ktls}) { $config{ktls}=""; - if ($target =~ m/^linux/) { -- my $usr = "/usr/$config{cross_compile_prefix}"; -- chop($usr); -- if ($config{cross_compile_prefix} eq "") { -- $usr = "/usr"; -- } -- my $minver = (4 << 16) + (13 << 8) + 0; -- my @verstr = split(" ",`cat $usr/include/linux/version.h | grep LINUX_VERSION_CODE`); -- -- if ($verstr[2] < $minver) { +- my $cc = $config{CROSS_COMPILE}.$config{CC}; +- if ($target =~ m/^linux/) { +- system("printf '#include <sys/types.h>\n#include <linux/tls.h>' | $cc -E - >/dev/null 2>&1"); +- if ($? != 0) { - disable('too-old-kernel', 'ktls'); - } - } elsif ($target =~ m/^BSD/) { - my $cc = $config{CROSS_COMPILE}.$config{CC}; - system("printf '#include <sys/types.h>\n#include <sys/ktls.h>' | $cc -E - >/dev/null 2>&1"); +- } elsif ($target =~ m/^BSD/) { +- system("printf '#include <sys/types.h>\n#include <sys/ktls.h>' | $cc -E - >/dev/null 2>&1"); +- if ($? != 0) { +- disable('too-old-freebsd', 'ktls'); +- } +- } else { +- disable('not-linux-or-freebsd', 'ktls'); +- } + } + + push @{$config{openssl_other_defines}}, "OPENSSL_NO_KTLS" if ($disabled{ktls}); diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix index 74e5d318bcb6..caec40ece19d 100644 --- a/pkgs/development/libraries/openssl/default.nix +++ b/pkgs/development/libraries/openssl/default.nix @@ -201,8 +201,8 @@ in { }; openssl_3 = common { - version = "3.0.5"; - sha256 = "sha256-qn2Nm+9xrWUlxVuhHl9Dl4ic5Jwsk0nc6m0+TwsCSno="; + version = "3.0.6"; + sha256 = "sha256-5KEKKYaUXj8aHy69aKx4BEmhdzuWtqF0/fZQ1ryWEfE="; patches = [ ./3.0/nix-ssl-cert-file.patch |