From 29ee41feff51c3269c2c160fa4d67de6ba5cca36 Mon Sep 17 00:00:00 2001 From: Markus Theil Date: Tue, 4 Jun 2024 17:58:36 +0200 Subject: [PATCH 1/3] openssl_3: 3.0.13 -> 3.0.14 Changelog: https://github.com/openssl/openssl/blob/openssl-3.0/CHANGES.md#changes-between-3013-and-3014-4-jun-2024 CVEs fixed: - Fixed potential use after free after SSL_free_buffers() is called. (CVE-2024-4741) - Fixed an issue where checking excessively long DSA keys or parameters may be very slow. (CVE-2024-4603) - Fixed an issue where some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions. An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service. (CVE-2024-2511) Signed-off-by: Markus Theil --- pkgs/development/libraries/openssl/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix index 0e144726cf85..74b9ddaa8162 100644 --- a/pkgs/development/libraries/openssl/default.nix +++ b/pkgs/development/libraries/openssl/default.nix @@ -267,8 +267,8 @@ in { }; openssl_3 = common { - version = "3.0.13"; - hash = "sha256-iFJXU/edO+wn0vp8ZqoLkrOqlJja/ZPXz6SzeAza4xM="; + version = "3.0.14"; + hash = "sha256-7soDXU3U6E/CWEbZUtpil0hK+gZQpvhMaC453zpBI8o="; patches = [ ./3.0/nix-ssl-cert-file.patch From 8e9d7fb6af2525637c60e6fb44e7c35f147ec0be Mon Sep 17 00:00:00 2001 From: Markus Theil Date: Tue, 4 Jun 2024 18:02:07 +0200 Subject: [PATCH 2/3] openssl_3_2: 3.2.1 -> 3.2.2 Changelog: https://github.com/openssl/openssl/blob/openssl-3.2/CHANGES.md#changes-between-321-and-322-4-jun-2024 CVEs fixed: - Fixed potential use after free after SSL_free_buffers() is called. (CVE-2024-4741) - Fixed an issue where checking excessively long DSA keys or parameters may be very slow. (CVE-2024-4603) - Fixed an issue where some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions. An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service. (CVE-2024-2511) Signed-off-by: Markus Theil --- pkgs/development/libraries/openssl/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix index 74b9ddaa8162..4e7cee58808c 100644 --- a/pkgs/development/libraries/openssl/default.nix +++ b/pkgs/development/libraries/openssl/default.nix @@ -290,8 +290,8 @@ in { }; openssl_3_2 = common { - version = "3.2.1"; - hash = "sha256-g8cyn+UshQZ3115dCwyiRTCbl+jsvP3B39xKufrDWzk="; + version = "3.2.2"; + hash = "sha256-GXFJwY2enyksQ/BACsq6EuX1LKz+BQ89GZJ36nOOwuc="; patches = [ ./3.0/nix-ssl-cert-file.patch From 88f9412faa53de2910fe893b5442c070f4beac38 Mon Sep 17 00:00:00 2001 From: Markus Theil Date: Tue, 4 Jun 2024 18:04:58 +0200 Subject: [PATCH 3/3] openssl_3_3: 3.3.0 -> 3.3.1 Changelog: https://github.com/openssl/openssl/blob/openssl-3.3/CHANGES.md#changes-between-330-and-331-4-jun-2024 CVEs fixed: - Fixed potential use after free after SSL_free_buffers() is called. (CVE-2024-4741) - Fixed an issue where checking excessively long DSA keys or parameters may be very slow. (CVE-2024-4603) Signed-off-by: Markus Theil --- pkgs/development/libraries/openssl/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix index 4e7cee58808c..0b17eaf800b7 100644 --- a/pkgs/development/libraries/openssl/default.nix +++ b/pkgs/development/libraries/openssl/default.nix @@ -313,8 +313,8 @@ in { }; openssl_3_3 = common { - version = "3.3.0"; - hash = "sha256-U+ZrBDMipgar8Ah+dpmg4DOjf6E/65dC3zXDozsY+wI="; + version = "3.3.1"; + hash = "sha256-d3zVlihMiDN1oqehG/XSeG/FQTJV76sgxQ1v/m0CC34="; patches = [ ./3.0/nix-ssl-cert-file.patch