From e907371b6199c5ef77364aea81a57989d0e1edd0 Mon Sep 17 00:00:00 2001 From: Yorick van Pelt Date: Sun, 9 Oct 2022 12:30:27 +0200 Subject: [PATCH 1/7] elfutils: move libmicrohttpd to 0.9.71 --- pkgs/development/tools/misc/elfutils/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/tools/misc/elfutils/default.nix b/pkgs/development/tools/misc/elfutils/default.nix index 16989c13b825..60afcbf258a5 100644 --- a/pkgs/development/tools/misc/elfutils/default.nix +++ b/pkgs/development/tools/misc/elfutils/default.nix @@ -1,7 +1,7 @@ { lib, stdenv, fetchurl, fetchpatch, pkg-config, musl-fts , musl-obstack, m4, zlib, zstd, bzip2, bison, flex, gettext, xz, setupDebugInfoDirs , argp-standalone -, enableDebuginfod ? false, sqlite, curl, libmicrohttpd_0_9_70, libarchive +, enableDebuginfod ? false, sqlite, curl, libmicrohttpd, libarchive , gitUpdater }: @@ -57,7 +57,7 @@ stdenv.mkDerivation rec { ] ++ lib.optionals enableDebuginfod [ sqlite curl - libmicrohttpd_0_9_70 + libmicrohttpd libarchive ]; From 4beb9675e32cde5ee323335c6404e4025ce70084 Mon Sep 17 00:00:00 2001 From: Yorick van Pelt Date: Sun, 9 Oct 2022 12:34:40 +0200 Subject: [PATCH 2/7] osmscout-server: move libmicrohttpd to 0.9.71 --- pkgs/applications/misc/osmscout-server/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/misc/osmscout-server/default.nix b/pkgs/applications/misc/osmscout-server/default.nix index cefce001eba9..9f057e3b019a 100644 --- a/pkgs/applications/misc/osmscout-server/default.nix +++ b/pkgs/applications/misc/osmscout-server/default.nix @@ -1,7 +1,7 @@ { lib, mkDerivation, fetchFromGitHub, pkg-config , qmake, qttools, kirigami2, qtquickcontrols2, qtlocation , libosmscout, valhalla, libpostal, osrm-backend, protobuf -, libmicrohttpd_0_9_70, sqlite, marisa, kyotocabinet, boost +, libmicrohttpd, sqlite, marisa, kyotocabinet, boost }: let @@ -27,7 +27,7 @@ mkDerivation rec { nativeBuildInputs = [ qmake pkg-config qttools ]; buildInputs = [ kirigami2 qtquickcontrols2 qtlocation - valhalla libosmscout osrm-backend libmicrohttpd_0_9_70 + valhalla libosmscout osrm-backend libmicrohttpd libpostal sqlite marisa kyotocabinet boost protobuf date ]; From 342e2816248ac4a96093d123dd3582373c8b1508 Mon Sep 17 00:00:00 2001 From: Yorick van Pelt Date: Sun, 9 Oct 2022 12:40:00 +0200 Subject: [PATCH 3/7] xmr-stak: switch libmicrohttpd to 0.9.71 --- pkgs/applications/misc/xmr-stak/default.nix | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/misc/xmr-stak/default.nix b/pkgs/applications/misc/xmr-stak/default.nix index 73d111979f33..5fffac0c7772 100644 --- a/pkgs/applications/misc/xmr-stak/default.nix +++ b/pkgs/applications/misc/xmr-stak/default.nix @@ -1,5 +1,5 @@ -{ stdenv, stdenvGcc6, lib -, fetchFromGitHub, cmake, libmicrohttpd_0_9_70, openssl +{ stdenv, lib, fetchpatch +, fetchFromGitHub, cmake, libmicrohttpd, openssl , opencl-headers, ocl-icd, hwloc , devDonationLevel ? "0.0" , openclSupport ? true @@ -18,11 +18,18 @@ stdenv.mkDerivation rec { NIX_CFLAGS_COMPILE = "-O3"; + patches = [ (fetchpatch { + name = "fix-libmicrohttpd-0-9-71.patch"; + url = "https://github.com/fireice-uk/xmr-stak/compare/06e08780eab54dbc025ce3f38c948e4eef2726a0...8adb208987f5881946992ab9cd9a45e4e2a4b870.patch"; + excludes = [ "CMakeLists.txt.user" ]; + hash = "sha256-Yv0U5EO1P5eikn1fKvUXEwemoUIjjeTjpP9p5J8pbC0="; + }) ]; + cmakeFlags = [ "-DCUDA_ENABLE=OFF" ] ++ lib.optional (!openclSupport) "-DOpenCL_ENABLE=OFF"; nativeBuildInputs = [ cmake ]; - buildInputs = [ libmicrohttpd_0_9_70 openssl hwloc ] + buildInputs = [ libmicrohttpd openssl hwloc ] ++ lib.optionals openclSupport [ opencl-headers ocl-icd ]; postPatch = '' From fe2d699e41317beadb4b075f8d1bb40309fe1a0d Mon Sep 17 00:00:00 2001 From: Yorick van Pelt Date: Mon, 10 Oct 2022 07:59:30 +0200 Subject: [PATCH 4/7] libmicrohttpd_0_9_69: init at 0.9.69 --- pkgs/development/libraries/libmicrohttpd/0.9.69.nix | 10 ++++++++++ pkgs/top-level/all-packages.nix | 1 + 2 files changed, 11 insertions(+) create mode 100644 pkgs/development/libraries/libmicrohttpd/0.9.69.nix diff --git a/pkgs/development/libraries/libmicrohttpd/0.9.69.nix b/pkgs/development/libraries/libmicrohttpd/0.9.69.nix new file mode 100644 index 000000000000..866658c224f3 --- /dev/null +++ b/pkgs/development/libraries/libmicrohttpd/0.9.69.nix @@ -0,0 +1,10 @@ +{ callPackage, fetchurl }: + +callPackage ./generic.nix ( rec { + version = "0.9.69"; + + src = fetchurl { + url = "mirror://gnu/libmicrohttpd/libmicrohttpd-${version}.tar.gz"; + sha256 = "sha256-+5trFIt4dJPmN9MINYhxHmXLy3JvoCzuLNVDxd4n434="; + }; +}) diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index f3cdbf696c65..01d5af044c91 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -20216,6 +20216,7 @@ with pkgs; libmemcached = callPackage ../development/libraries/libmemcached { }; + libmicrohttpd_0_9_69 = callPackage ../development/libraries/libmicrohttpd/0.9.69.nix { }; libmicrohttpd_0_9_70 = callPackage ../development/libraries/libmicrohttpd/0.9.70.nix { }; libmicrohttpd_0_9_71 = callPackage ../development/libraries/libmicrohttpd/0.9.71.nix { }; libmicrohttpd_0_9_72 = callPackage ../development/libraries/libmicrohttpd/0.9.72.nix { }; From a9cd13546b0bfea319ce71f359a12710946b84a1 Mon Sep 17 00:00:00 2001 From: Yorick van Pelt Date: Mon, 10 Oct 2022 07:59:49 +0200 Subject: [PATCH 5/7] proxysql: switch libmicrohttpd from 0.9.70 to 0.9.69 0.9.70 is vulnerable to CVE-2021-3466, but 0.9.69 is fine. proxysql is not yet compatible with 0.9.71 --- pkgs/servers/sql/proxysql/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/sql/proxysql/default.nix b/pkgs/servers/sql/proxysql/default.nix index b8748368c50d..97b0591cbff7 100644 --- a/pkgs/servers/sql/proxysql/default.nix +++ b/pkgs/servers/sql/proxysql/default.nix @@ -16,7 +16,7 @@ , libev , libgcrypt , libinjection -, libmicrohttpd_0_9_70 +, libmicrohttpd_0_9_69 , libuuid , lz4 , nlohmann_json @@ -100,7 +100,7 @@ stdenv.mkDerivation rec { { f = "libdaemon"; p = libdaemon; } { f = "libev"; p = libev; } { f = "libinjection"; p = libinjection; } - { f = "libmicrohttpd"; p = libmicrohttpd_0_9_70; } + { f = "libmicrohttpd"; p = libmicrohttpd_0_9_69; } { f = "libssl"; p = openssl; } { f = "lz4"; p = lz4; } { f = "pcre"; p = pcre; } From 4902637cc2c816e5746f09b01b62305302584be8 Mon Sep 17 00:00:00 2001 From: Yorick van Pelt Date: Mon, 10 Oct 2022 08:02:52 +0200 Subject: [PATCH 6/7] libmicrohttpd_0_9_70: mark as insecure --- pkgs/development/libraries/libmicrohttpd/0.9.70.nix | 1 + pkgs/development/libraries/libmicrohttpd/generic.nix | 8 ++++++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/libmicrohttpd/0.9.70.nix b/pkgs/development/libraries/libmicrohttpd/0.9.70.nix index c0321e327c52..e28e0512ae37 100644 --- a/pkgs/development/libraries/libmicrohttpd/0.9.70.nix +++ b/pkgs/development/libraries/libmicrohttpd/0.9.70.nix @@ -7,4 +7,5 @@ callPackage ./generic.nix ( rec { url = "mirror://gnu/libmicrohttpd/libmicrohttpd-${version}.tar.gz"; sha256 = "01vkjy89b1ylmh22dy5yza2r414nfwcfixxh3v29nvzrjv9s7l4h"; }; + meta.knownVulnerabilities = [ "CVE-2021-3466" ]; }) diff --git a/pkgs/development/libraries/libmicrohttpd/generic.nix b/pkgs/development/libraries/libmicrohttpd/generic.nix index 336b66ac8323..0af066c71238 100644 --- a/pkgs/development/libraries/libmicrohttpd/generic.nix +++ b/pkgs/development/libraries/libmicrohttpd/generic.nix @@ -1,4 +1,8 @@ -{ lib, stdenv, libgcrypt, curl, gnutls, pkg-config, libiconv, libintl, version, src }: +{ lib, stdenv, libgcrypt, curl, gnutls, pkg-config, libiconv, libintl, version, src, meta ? {} }: + +let + meta_ = meta; +in stdenv.mkDerivation rec { pname = "libmicrohttpd"; @@ -30,5 +34,5 @@ stdenv.mkDerivation rec { maintainers = with maintainers; [ eelco vrthra fpletz ]; platforms = platforms.unix; - }; + } // meta_; } From 32f1678683e05e82b454ab3234c10bd01bf0ce6e Mon Sep 17 00:00:00 2001 From: Yorick van Pelt Date: Mon, 10 Oct 2022 08:06:35 +0200 Subject: [PATCH 7/7] libmicrohttpd_0_9_70: drop --- pkgs/development/libraries/libmicrohttpd/0.9.70.nix | 11 ----------- pkgs/top-level/aliases.nix | 1 + pkgs/top-level/all-packages.nix | 1 - 3 files changed, 1 insertion(+), 12 deletions(-) delete mode 100644 pkgs/development/libraries/libmicrohttpd/0.9.70.nix diff --git a/pkgs/development/libraries/libmicrohttpd/0.9.70.nix b/pkgs/development/libraries/libmicrohttpd/0.9.70.nix deleted file mode 100644 index e28e0512ae37..000000000000 --- a/pkgs/development/libraries/libmicrohttpd/0.9.70.nix +++ /dev/null @@ -1,11 +0,0 @@ -{ callPackage, fetchurl }: - -callPackage ./generic.nix ( rec { - version = "0.9.70"; - - src = fetchurl { - url = "mirror://gnu/libmicrohttpd/libmicrohttpd-${version}.tar.gz"; - sha256 = "01vkjy89b1ylmh22dy5yza2r414nfwcfixxh3v29nvzrjv9s7l4h"; - }; - meta.knownVulnerabilities = [ "CVE-2021-3466" ]; -}) diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index 2ef122ba137d..7af2e169d09d 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -613,6 +613,7 @@ mapAliases ({ liblapackWithoutAtlas = throw "'liblapackWithoutAtlas' has been renamed to/replaced by 'lapack-reference'"; # Converted to throw 2022-02-22 liblastfm = throw "'liblastfm' has been renamed to/replaced by 'libsForQt5.liblastfm'"; # Converted to throw 2022-09-24 liblrdf = throw "'liblrdf' has been renamed to/replaced by 'lrdf'"; # Converted to throw 2022-02-22 + libmicrohttpd_0_9_70 = throw "'libmicrohttpd_0_9_70' has been removed because it is insecure, and has been replaced by 'libmicrohttpd_0_9_69' and 'libmicrohttpd_0_9_71'"; # Added 2022-10-10 libmsgpack = throw "'libmsgpack' has been renamed to/replaced by 'msgpack'"; # Converted to throw 2022-02-22 libnih = throw "'libnih' has been removed"; # Converted to throw 2022-05-17 libosmpbf = throw "libosmpbf was removed because it is no longer required by osrm-backend"; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 01d5af044c91..be05f266be4c 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -20217,7 +20217,6 @@ with pkgs; libmemcached = callPackage ../development/libraries/libmemcached { }; libmicrohttpd_0_9_69 = callPackage ../development/libraries/libmicrohttpd/0.9.69.nix { }; - libmicrohttpd_0_9_70 = callPackage ../development/libraries/libmicrohttpd/0.9.70.nix { }; libmicrohttpd_0_9_71 = callPackage ../development/libraries/libmicrohttpd/0.9.71.nix { }; libmicrohttpd_0_9_72 = callPackage ../development/libraries/libmicrohttpd/0.9.72.nix { }; libmicrohttpd = libmicrohttpd_0_9_71;