diff options
author | Alyssa Ross <hi@alyssa.is> | 2023-08-23 10:09:14 +0000 |
---|---|---|
committer | Alyssa Ross <hi@alyssa.is> | 2023-08-26 09:07:03 +0000 |
commit | 63dabcc77ef9a56655e1ca2ab2e25e6163a72c1f (patch) | |
tree | d58934cb48f9c953b19a0d0d5cffc0d0c5561471 /nixpkgs/pkgs/development/libraries/openssl | |
parent | c4eef3dacb2a3d359561f30917d9e3cc4e041be9 (diff) | |
parent | 91a22f76cd1716f9d0149e8a5c68424bb691de15 (diff) | |
download | nixlib-63dabcc77ef9a56655e1ca2ab2e25e6163a72c1f.tar nixlib-63dabcc77ef9a56655e1ca2ab2e25e6163a72c1f.tar.gz nixlib-63dabcc77ef9a56655e1ca2ab2e25e6163a72c1f.tar.bz2 nixlib-63dabcc77ef9a56655e1ca2ab2e25e6163a72c1f.tar.lz nixlib-63dabcc77ef9a56655e1ca2ab2e25e6163a72c1f.tar.xz nixlib-63dabcc77ef9a56655e1ca2ab2e25e6163a72c1f.tar.zst nixlib-63dabcc77ef9a56655e1ca2ab2e25e6163a72c1f.zip |
Merge branch 'nixos-unstable' of https://github.com/NixOS/nixpkgs
Conflicts: nixpkgs/pkgs/build-support/go/module.nix nixpkgs/pkgs/development/python-modules/django-mailman3/default.nix
Diffstat (limited to 'nixpkgs/pkgs/development/libraries/openssl')
-rw-r--r-- | nixpkgs/pkgs/development/libraries/openssl/3.0/CVE-2023-2975.patch | 54 | ||||
-rw-r--r-- | nixpkgs/pkgs/development/libraries/openssl/default.nix | 7 |
2 files changed, 2 insertions, 59 deletions
diff --git a/nixpkgs/pkgs/development/libraries/openssl/3.0/CVE-2023-2975.patch b/nixpkgs/pkgs/development/libraries/openssl/3.0/CVE-2023-2975.patch deleted file mode 100644 index d1622977b64d..000000000000 --- a/nixpkgs/pkgs/development/libraries/openssl/3.0/CVE-2023-2975.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc Mon Sep 17 00:00:00 2001 -From: Tomas Mraz <tomas@openssl.org> -Date: Tue, 4 Jul 2023 17:30:35 +0200 -Subject: [PATCH] Do not ignore empty associated data with AES-SIV mode - -The AES-SIV mode allows for multiple associated data items -authenticated separately with any of these being 0 length. - -The provided implementation ignores such empty associated data -which is incorrect in regards to the RFC 5297 and is also -a security issue because such empty associated data then become -unauthenticated if an application expects to authenticate them. - -Fixes CVE-2023-2975 - -Reviewed-by: Matt Caswell <matt@openssl.org> -Reviewed-by: Paul Dale <pauli@openssl.org> -(Merged from https://github.com/openssl/openssl/pull/21384) - -(cherry picked from commit c426c281cfc23ab182f7d7d7a35229e7db1494d9) ---- - .../implementations/ciphers/cipher_aes_siv.c | 18 +++++++++++------- - 1 file changed, 11 insertions(+), 7 deletions(-) - -diff --git a/providers/implementations/ciphers/cipher_aes_siv.c b/providers/implementations/ciphers/cipher_aes_siv.c -index 45010b90db2a..b396c8651a32 100644 ---- a/providers/implementations/ciphers/cipher_aes_siv.c -+++ b/providers/implementations/ciphers/cipher_aes_siv.c -@@ -120,14 +120,18 @@ static int siv_cipher(void *vctx, unsigned char *out, size_t *outl, - if (!ossl_prov_is_running()) - return 0; - -- if (inl == 0) { -- *outl = 0; -- return 1; -- } -+ /* Ignore just empty encryption/decryption call and not AAD. */ -+ if (out != NULL) { -+ if (inl == 0) { -+ if (outl != NULL) -+ *outl = 0; -+ return 1; -+ } - -- if (outsize < inl) { -- ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL); -- return 0; -+ if (outsize < inl) { -+ ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL); -+ return 0; -+ } - } - - if (ctx->hw->cipher(ctx, out, in, inl) <= 0) diff --git a/nixpkgs/pkgs/development/libraries/openssl/default.nix b/nixpkgs/pkgs/development/libraries/openssl/default.nix index fae2c5f1cc2f..aaee6685cfc5 100644 --- a/nixpkgs/pkgs/development/libraries/openssl/default.nix +++ b/nixpkgs/pkgs/development/libraries/openssl/default.nix @@ -254,8 +254,8 @@ in { }; openssl_3 = common { - version = "3.0.9"; - sha256 = "sha256-6xqwR4FHQ2D3fDGKuJ2MWgOrw45j1lpgPKu/GwCh3JA="; + version = "3.0.10"; + sha256 = "sha256-F2HU9bE6ECi5tvPUuOF/6wztyTcPav5h1xk9LNzoMyM="; patches = [ ./3.0/nix-ssl-cert-file.patch @@ -263,9 +263,6 @@ in { # This patch disables build-time detection. ./3.0/openssl-disable-kernel-detection.patch - # https://www.openssl.org/news/secadv/20230714.txt - ./3.0/CVE-2023-2975.patch - (if stdenv.hostPlatform.isDarwin then ./use-etc-ssl-certs-darwin.patch else ./use-etc-ssl-certs.patch) |