From 0a3e68ba844bf17891c8702604b6149f556b447c Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Fri, 6 Jan 2023 21:02:33 +0100 Subject: [PATCH] unzip: apply patch for CVE-2022-0529 and CVE-2022-0530 https://lists.debian.org/debian-lts-announce/2022/09/msg00028.html https://github.com/ByteHackr/unzip_poc --- pkgs/tools/archivers/unzip/default.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/pkgs/tools/archivers/unzip/default.nix b/pkgs/tools/archivers/unzip/default.nix index e7f22ad0ff96..f61bc9df66d5 100644 --- a/pkgs/tools/archivers/unzip/default.nix +++ b/pkgs/tools/archivers/unzip/default.nix @@ -51,6 +51,15 @@ stdenv.mkDerivation rec { ]; sha256 = "1h00djdvgjhwfb60wl4qrxbyfsbbnn1qw6l2hkldnif4m8f8r1zj"; }) + (fetchurl { + urls = [ + # original link (will be dead eventually): + "https://sources.debian.org/data/main/u/unzip/6.0-27/debian/patches/28-cve-2022-0529-and-cve-2022-0530.patch" + + "https://web.archive.org/web/20230106200319/https://sources.debian.org/data/main/u/unzip/6.0-27/debian/patches/28-cve-2022-0529-and-cve-2022-0530.patch" + ]; + sha256 = "sha256-on79jElQ+z2ULWAq14RpluAqr9d6itHiZwDkKubBzTc="; + }) ] ++ lib.optional enableNLS (fetchurl { url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-arch/unzip/files/unzip-6.0-natspec.patch?id=56bd759df1d0c750a065b8c845e93d5dfa6b549d";