b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

openssl: 3.0.7 -> 3.0.8

Browse source 
https://github.com/openssl/openssl/blob/openssl-3.0.8/NEWS.md

Fixes: CVE-2023-0401, CVE-2023-0286, CVE-2023-0217, CVE-2023-0216,
       CVE-2023-0215, CVE-2022-4450, CVE-2022-4304, CVE-2022-4203,
       CVE-2022-3996
This commit is contained in:
Martin Weinelt 2023-02-07 16:40:10 +01:00
parent 41e5bd55d5
commit 15cf84feea
No known key found for this signature in database
GPG key ID: 87C1E9888F856759
2 changed files with 2 additions and 41 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

36
pkgs/development/libraries/openssl/3.0/CVE-2022-3996.patch
View file

@ -1,36 +0,0 @@
From 7725e7bfe6f2ce8146b6552b44e0d226be7638e7 Mon Sep 17 00:00:00 2001
From: Pauli <pauli@openssl.org>
Date: Fri, 11 Nov 2022 09:40:19 +1100
Subject: [PATCH] x509: fix double locking problem
This reverts commit 9aa4be691f5c73eb3c68606d824c104550c053f7 and removed the
redundant flag setting.
Fixes #19643
Fixes LOW CVE-2022-3996
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19652)
(cherry picked from commit 4d0340a6d2f327700a059f0b8f954d6160f8eef5)
---
crypto/x509/pcy_map.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/crypto/x509/pcy_map.c b/crypto/x509/pcy_map.c
index 05406c6493fc..60dfd1e3203b 100644
--- a/crypto/x509/pcy_map.c
+++ b/crypto/x509/pcy_map.c
@@ -73,10 +73,6 @@ int ossl_policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps)
ret = 1;
bad_mapping:
- if (ret == -1 && CRYPTO_THREAD_write_lock(x->lock)) {
- x->ex_flags |= EXFLAG_INVALID_POLICY;
- CRYPTO_THREAD_unlock(x->lock);
- }
sk_POLICY_MAPPING_pop_free(maps, POLICY_MAPPING_free);
return ret;

7
pkgs/development/libraries/openssl/default.nix
View file

@ -229,8 +229,8 @@ in {
};
openssl_3 = common {
version = "3.0.7";
sha256 = "sha256-gwSdBComDmlvYkBqxcCL9wb9hDg/lFzyG9YentlcOW4=";
version = "3.0.8";
sha256 = "sha256-bBPSvzj98x6sPOKjRwc2c/XWMmM5jx9p0N9KQSU+Sz4=";
patches = [
./3.0/nix-ssl-cert-file.patch
@ -241,9 +241,6 @@ in {
(if stdenv.hostPlatform.isDarwin
then ./use-etc-ssl-certs-darwin.patch
else ./use-etc-ssl-certs.patch)
# Remove with 3.0.8 release
./3.0/CVE-2022-3996.patch
];
withDocs = true;