diff options
| author | Robert Scott <code@humanleg.org.uk> | 2023-04-05 11:02:45 +0100 |
|---|---|---|
| committer | Robert Scott <code@humanleg.org.uk> | 2023-04-05 13:42:00 +0100 |
| commit | cec89d1a26b7abd5de27301777844ea806a6eef0 (patch) | |
| tree | 5f5005a8d14a6d910f065a61101b169e93b4c92d | |
| parent | Merge #223595: staging-next-22.11 - iteration 6 (diff) | |
| download | nixpkgs-cec89d1a26b7abd5de27301777844ea806a6eef0.tar.gz | |
timescaledb: add patch for CVE-2023-25149
| -rw-r--r-- | pkgs/servers/sql/postgresql/ext/timescaledb.nix | 17 |
1 files changed, 16 insertions, 1 deletions
diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/pkgs/servers/sql/postgresql/ext/timescaledb.nix index 2f857b1e8d23..3988fafb1cb2 100644 --- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix +++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix @@ -1,4 +1,4 @@ -{ lib, stdenv, fetchFromGitHub, cmake, postgresql, openssl, libkrb5 }: +{ lib, stdenv, fetchFromGitHub, cmake, postgresql, openssl, libkrb5, fetchpatch }: # # To enable on NixOS: # config.services.postgresql = { @@ -20,6 +20,21 @@ stdenv.mkDerivation rec { sha256 = "sha256-2ayWm1lXR1rgDHdpKO0gMJzGRag95qVPU7jSCJRtar0="; }; + patches = [ + (fetchpatch { + name = "CVE-2023-25149.patch"; + url = "https://github.com/timescale/timescaledb/commit/789bb26dfbf1aaf85163e5ddfc70fa6dae0894fb.patch"; + excludes = [ + "CHANGELOG.md" + # 2.8.1 doesn't yet have any SPI calls in this file to protect. a cursory + # audit of the full source shows no unprotected SPI_connect/ext calls once + # this patch is applied + "src/telemetry/telemetry.c" + ]; + sha256 = "sha256-AaikftbXMQPnBo6BT6Nad05X40/hZpqpuC4gXWk6hgk="; + }) + ]; + cmakeFlags = [ "-DSEND_TELEMETRY_DEFAULT=OFF" "-DREGRESS_CHECKS=OFF" "-DTAP_CHECKS=OFF" ] ++ lib.optionals stdenv.isDarwin [ "-DLINTER=OFF" ]; |