From c05c515eff3cb57822df6399e923d05b24c4ede7 Mon Sep 17 00:00:00 2001 From: Markus Theil Date: Fri, 10 Jan 2025 18:27:20 +0100 Subject: [PATCH 1/3] openssl_3_4: init at 3.4.1; openssl_3_3: remove Updates OpenSSL 3.x latest to 3.4.1 Security Fixes in 3.4.1: * Fixed RFC7250 handshakes with unauthenticated servers don't abort as expected. ([CVE-2024-12797]) * Fixed timing side-channel in ECDSA signature computation. ([CVE-2024-13176](https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176)) Release notes: https://github.com/openssl/openssl/blob/openssl-3.4.0/NEWS.md#openssl-34 Some significant changes: * Deprecation of TS_VERIFY_CTX_set_* functions and addition of replacement TS_VERIFY_CTX_set0_* functions with improved semantics * SHAKE-128 and SHAKE-256 implementations have no default digest length anymore. That means these algorithms cannot be used with EVP_DigestFinal/_ex() unless the xoflen param is set before. * An empty renegotiate extension will be used in TLS client hellos instead of the empty renegotiation SCSV, for all connections with a minimum TLS version > 1.0. * Deprecation of SSL_SESSION_get_time(), SSL_SESSION_set_time() and SSL_CTX_flush_sessions() functions in favor of their respective _ex functions which are Y2038-safe on platforms with Y2038-safe time_t Some new features: * Support for directly fetched composite signature algorithms such as RSA-SHA2-256 including new API functions * New options -not_before and -not_after for explicit setting start and end dates of certificates created with the req and x509 apps * Support for attribute certificates * Support for pkeyutl in combination with key encapsulation (e.q. PQC-KEMs): -encap/-decap Signed-off-by: Markus Theil --- .../{3.3 => 3.4}/use-etc-ssl-certs-darwin.patch | 0 .../openssl/{3.3 => 3.4}/use-etc-ssl-certs.patch | 0 pkgs/development/libraries/openssl/default.nix | 10 +++++----- pkgs/top-level/all-packages.nix | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-) rename pkgs/development/libraries/openssl/{3.3 => 3.4}/use-etc-ssl-certs-darwin.patch (100%) rename pkgs/development/libraries/openssl/{3.3 => 3.4}/use-etc-ssl-certs.patch (100%) diff --git a/pkgs/development/libraries/openssl/3.3/use-etc-ssl-certs-darwin.patch b/pkgs/development/libraries/openssl/3.4/use-etc-ssl-certs-darwin.patch similarity index 100% rename from pkgs/development/libraries/openssl/3.3/use-etc-ssl-certs-darwin.patch rename to pkgs/development/libraries/openssl/3.4/use-etc-ssl-certs-darwin.patch diff --git a/pkgs/development/libraries/openssl/3.3/use-etc-ssl-certs.patch b/pkgs/development/libraries/openssl/3.4/use-etc-ssl-certs.patch similarity index 100% rename from pkgs/development/libraries/openssl/3.3/use-etc-ssl-certs.patch rename to pkgs/development/libraries/openssl/3.4/use-etc-ssl-certs.patch diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix index f0cf68f8b6aa..51e71d15368e 100644 --- a/pkgs/development/libraries/openssl/default.nix +++ b/pkgs/development/libraries/openssl/default.nix @@ -366,9 +366,9 @@ in }; }; - openssl_3_3 = common { - version = "3.3.2"; - hash = "sha256-LopAsBl5r+i+C7+z3l3BxnCf7bRtbInBDaEUq1/D0oE="; + openssl_3_4 = common { + version = "3.4.1"; + hash = "sha256-1LIlJ6ZFrPdrU+REh6jbaHxu7WIdckaJHQJeOLqMllE="; patches = [ ./3.0/nix-ssl-cert-file.patch @@ -379,9 +379,9 @@ in ( if stdenv.hostPlatform.isDarwin then - ./3.3/use-etc-ssl-certs-darwin.patch + ./3.4/use-etc-ssl-certs-darwin.patch else - ./3.3/use-etc-ssl-certs.patch + ./3.4/use-etc-ssl-certs.patch ) ]; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 43d90812ebe1..fd2b75bb5c47 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -10196,7 +10196,7 @@ with pkgs; inherit (darwin.apple_sdk_11_0.frameworks) Security; }; - openssl = openssl_3_3; + openssl = openssl_3_4; openssl_legacy = openssl.override { conf = ../development/libraries/openssl/3.0/legacy.cnf; @@ -10205,7 +10205,7 @@ with pkgs; inherit (callPackages ../development/libraries/openssl { }) openssl_1_1 openssl_3 - openssl_3_3; + openssl_3_4; openwebrx = callPackage ../applications/radio/openwebrx { inherit (python3Packages) From 7a64edd4dfaf3583f7e5621fc4679a157f768444 Mon Sep 17 00:00:00 2001 From: Markus Theil Date: Fri, 10 Jan 2025 21:03:51 +0100 Subject: [PATCH 2/3] quictls: fix openssl patch paths for 3.4 Fix paths related to OpenSSL 3.4.x patches. Signed-off-by: Markus Theil --- pkgs/development/libraries/quictls/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/quictls/default.nix b/pkgs/development/libraries/quictls/default.nix index 63ddc6313d6a..a36d230fcbbc 100644 --- a/pkgs/development/libraries/quictls/default.nix +++ b/pkgs/development/libraries/quictls/default.nix @@ -32,8 +32,8 @@ stdenv.mkDerivation rec { ../openssl/3.0/openssl-disable-kernel-detection.patch (if stdenv.hostPlatform.isDarwin - then ../openssl/3.3/use-etc-ssl-certs-darwin.patch - else ../openssl/3.3/use-etc-ssl-certs.patch) + then ../openssl/3.4/use-etc-ssl-certs-darwin.patch + else ../openssl/3.4/use-etc-ssl-certs.patch) ]; postPatch = '' From 9a706eda06d4d5848af16359875df4fa1311cfb8 Mon Sep 17 00:00:00 2001 From: Markus Theil Date: Tue, 11 Feb 2025 16:02:03 +0100 Subject: [PATCH 3/3] openssl_3: 3.0.15 -> 3.0.16 Security Fixes in 3.0.16: * Fixed timing side-channel in ECDSA signature computation. (CVE-2024-13176) * Fixed possible OOB memory access with invalid low-level GF(2^m) elliptic curve parameters. (CVE-2024-9143) Signed-off-by: Markus Theil --- pkgs/development/libraries/openssl/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix index 51e71d15368e..624904c170bb 100644 --- a/pkgs/development/libraries/openssl/default.nix +++ b/pkgs/development/libraries/openssl/default.nix @@ -344,8 +344,8 @@ in }; openssl_3 = common { - version = "3.0.15"; - hash = "sha256-I8Zm0O3yDxQkmz2PA2isrumrWFsJ4d6CEHxm4fPslTM="; + version = "3.0.16"; + hash = "sha256-V+A8UP6rXTGxUq8rdk8QN5rs2O6S8WyYWYPOSpn374Y="; patches = [ ./3.0/nix-ssl-cert-file.patch