1 files changed, 21 insertions, 6 deletions
diff --git a/nixpkgs/pkgs/applications/networking/browsers/lynx/default.nix b/nixpkgs/pkgs/applications/networking/browsers/lynx/default.nix
index 713f934f7789..e2d6854295a5 100644
--- a/nixpkgs/pkgs/applications/networking/browsers/lynx/default.nix
+++ b/nixpkgs/pkgs/applications/networking/browsers/lynx/default.nix
@@ -1,11 +1,16 @@
-{ lib, stdenv, buildPackages
-, fetchurl, pkg-config, ncurses, gzip
-, sslSupport ? true, openssl ? null
+{ lib
+, stdenv
+, buildPackages
+, fetchurl
+, pkg-config
+, ncurses
+, gzip
+, sslSupport ? true
+, openssl
 , nukeReferences
+, fetchpatch
 }:
 
-assert sslSupport -> openssl != null;
-
 stdenv.mkDerivation rec {
   pname = "lynx";
   version = "2.8.9rel.1";
@@ -22,6 +27,14 @@ stdenv.mkDerivation rec {
 
   hardeningEnable = [ "pie" ];
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2021-38165.patch";
+      url = "https://git.alpinelinux.org/aports/plain/main/lynx/CVE-2021-38165.patch?id=3400945dbbb8a87065360963e4caa0e17d3dcc61";
+      sha256 = "1aykb9y2g2vdpbbpvjlm4r40x7py2yv6jbywwcqcxrlciqcw4x57";
+    })
+  ];
+
   configureFlags = [
     "--enable-default-colors"
     "--enable-widec"
@@ -32,7 +45,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ nukeReferences ]
     ++ lib.optional sslSupport pkg-config;
 
-  buildInputs = [ ncurses gzip ] ++ lib.optional sslSupport openssl.dev;
+  buildInputs = [ ncurses gzip ]
+    ++ lib.optional sslSupport openssl;
 
   # cfg_defs.h captures lots of references to build-only dependencies, derived
   # from config.cache.
@@ -44,6 +58,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A text-mode web browser";
     homepage = "https://lynx.invisible-island.net/";
+    maintainers = with maintainers; [ ];
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
   };