whisper: set knownVulnerabilities due to dated vendored libraries (#457885)

2025-11-17 09:17:05 +00:00
parent 5c7408b3fe afc8879d24
commit 30d55d2ae3
1 changed files with 9 additions and 0 deletions
--- a/pkgs/by-name/wh/whisper/package.nix
+++ b/pkgs/by-name/wh/whisper/package.nix
@@ -51,6 +51,15 @@ stdenv.mkDerivation rec {
    broken = stdenv.hostPlatform.isDarwin;
    description = "Short read sequence mapper";
    license = licenses.gpl3;
+    # vendored libraries acof, aelf, deflate, bzip2, zlib
+    # https://github.com/refresh-bio/Whisper/issues/18
+    knownVulnerabilities = [
+      # src/libs/libz.a from 2017
+      "CVE-2018-25032"
+      "CVE-2022-37434"
+      # src/libs/libbzip2.lib
+      "CVE-2019-12900"
+    ];
    homepage = "https://github.com/refresh-bio/whisper";
    maintainers = with maintainers; [ jbedo ];
    platforms = platforms.x86_64;