diff options
| author | Martin Weinelt <hexa@darmstadt.ccc.de> | 2023-02-07 16:40:10 +0100 |
|---|---|---|
| committer | Martin Weinelt <hexa@darmstadt.ccc.de> | 2023-02-07 17:02:33 +0100 |
| commit | 15cf84feea87949eb01b9b6e631246fe6991cd3a (patch) | |
| tree | 5c6a757795d9c4420f1694b94faa7241aa47d66d | |
| parent | Merge master into staging-next (diff) | |
| download | nixpkgs-15cf84feea87949eb01b9b6e631246fe6991cd3a.tar.gz | |
openssl: 3.0.7 -> 3.0.8
https://github.com/openssl/openssl/blob/openssl-3.0.8/NEWS.md
Fixes: CVE-2023-0401, CVE-2023-0286, CVE-2023-0217, CVE-2023-0216,
CVE-2023-0215, CVE-2022-4450, CVE-2022-4304, CVE-2022-4203,
CVE-2022-3996
| -rw-r--r-- | pkgs/development/libraries/openssl/3.0/CVE-2022-3996.patch | 36 | ||||
| -rw-r--r-- | pkgs/development/libraries/openssl/default.nix | 7 |
2 files changed, 2 insertions, 41 deletions
diff --git a/pkgs/development/libraries/openssl/3.0/CVE-2022-3996.patch b/pkgs/development/libraries/openssl/3.0/CVE-2022-3996.patch deleted file mode 100644 index 2acedda0e3a4..000000000000 --- a/pkgs/development/libraries/openssl/3.0/CVE-2022-3996.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 7725e7bfe6f2ce8146b6552b44e0d226be7638e7 Mon Sep 17 00:00:00 2001 -From: Pauli <pauli@openssl.org> -Date: Fri, 11 Nov 2022 09:40:19 +1100 -Subject: [PATCH] x509: fix double locking problem - -This reverts commit 9aa4be691f5c73eb3c68606d824c104550c053f7 and removed the -redundant flag setting. - -Fixes #19643 - -Fixes LOW CVE-2022-3996 - -Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> -Reviewed-by: Tomas Mraz <tomas@openssl.org> -(Merged from https://github.com/openssl/openssl/pull/19652) - -(cherry picked from commit 4d0340a6d2f327700a059f0b8f954d6160f8eef5) ---- - crypto/x509/pcy_map.c | 4 ---- - 1 file changed, 4 deletions(-) - -diff --git a/crypto/x509/pcy_map.c b/crypto/x509/pcy_map.c -index 05406c6493fc..60dfd1e3203b 100644 ---- a/crypto/x509/pcy_map.c -+++ b/crypto/x509/pcy_map.c -@@ -73,10 +73,6 @@ int ossl_policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps) - - ret = 1; - bad_mapping: -- if (ret == -1 && CRYPTO_THREAD_write_lock(x->lock)) { -- x->ex_flags |= EXFLAG_INVALID_POLICY; -- CRYPTO_THREAD_unlock(x->lock); -- } - sk_POLICY_MAPPING_pop_free(maps, POLICY_MAPPING_free); - return ret; - diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix index 4c322997963a..df907f34ced4 100644 --- a/pkgs/development/libraries/openssl/default.nix +++ b/pkgs/development/libraries/openssl/default.nix @@ -229,8 +229,8 @@ in { }; openssl_3 = common { - version = "3.0.7"; - sha256 = "sha256-gwSdBComDmlvYkBqxcCL9wb9hDg/lFzyG9YentlcOW4="; + version = "3.0.8"; + sha256 = "sha256-bBPSvzj98x6sPOKjRwc2c/XWMmM5jx9p0N9KQSU+Sz4="; patches = [ ./3.0/nix-ssl-cert-file.patch @@ -241,9 +241,6 @@ in { (if stdenv.hostPlatform.isDarwin then ./use-etc-ssl-certs-darwin.patch else ./use-etc-ssl-certs.patch) - - # Remove with 3.0.8 release - ./3.0/CVE-2022-3996.patch ]; withDocs = true; |