From 3fccac4914d428169757f52ce9c94c0966cb889b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Wed, 28 Jan 2026 08:15:49 +0100 Subject: [PATCH] openssl_3: 3.0.18 -> 3.0.19 The second item (severity: High) has possible unauthenticated RCE: https://www.openwall.com/lists/oss-security/2026/01/27/5 https://github.com/openssl/openssl/blob/openssl-3.0.19/CHANGES.md#openssl-30 The patches differ in whitespace only, as that's what upstream changed. --- pkgs/development/libraries/openssl/default.nix | 4 ++-- .../openssl/use-etc-ssl-certs-darwin.patch | 16 ++++++++-------- .../libraries/openssl/use-etc-ssl-certs.patch | 16 ++++++++-------- 3 files changed, 18 insertions(+), 18 deletions(-) diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix index 3ce6b0acb111..b4aff30cb3c0 100644 --- a/pkgs/development/libraries/openssl/default.nix +++ b/pkgs/development/libraries/openssl/default.nix @@ -429,8 +429,8 @@ in }; openssl_3 = common { - version = "3.0.18"; - hash = "sha256-2Aw09c+QLczx8bXfXruG0DkuNwSeXXPfGzq65y5P/os="; + version = "3.0.19"; + hash = "sha256-+lpBQ7iq4YvlPvLzyvKaLgdHQwuLx00y2IM1uUq2MHI="; patches = [ # Support for NIX_SSL_CERT_FILE, motivation: diff --git a/pkgs/development/libraries/openssl/use-etc-ssl-certs-darwin.patch b/pkgs/development/libraries/openssl/use-etc-ssl-certs-darwin.patch index 2c98ccfa7ed0..1699cbfb20e5 100644 --- a/pkgs/development/libraries/openssl/use-etc-ssl-certs-darwin.patch +++ b/pkgs/development/libraries/openssl/use-etc-ssl-certs-darwin.patch @@ -3,11 +3,11 @@ index 329ef62..9a8df64 100644 --- a/include/internal/cryptlib.h +++ b/include/internal/cryptlib.h @@ -56,7 +56,7 @@ DEFINE_LHASH_OF(MEM); - # ifndef OPENSSL_SYS_VMS - # define X509_CERT_AREA OPENSSLDIR - # define X509_CERT_DIR OPENSSLDIR "/certs" --# define X509_CERT_FILE OPENSSLDIR "/cert.pem" -+# define X509_CERT_FILE "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt" - # define X509_PRIVATE_DIR OPENSSLDIR "/private" - # define CTLOG_FILE OPENSSLDIR "/ct_log_list.cnf" - # else + #ifndef OPENSSL_SYS_VMS + #define X509_CERT_AREA OPENSSLDIR + #define X509_CERT_DIR OPENSSLDIR "/certs" +-#define X509_CERT_FILE OPENSSLDIR "/cert.pem" ++#define X509_CERT_FILE "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt" + #define X509_PRIVATE_DIR OPENSSLDIR "/private" + #define CTLOG_FILE OPENSSLDIR "/ct_log_list.cnf" + #else diff --git a/pkgs/development/libraries/openssl/use-etc-ssl-certs.patch b/pkgs/development/libraries/openssl/use-etc-ssl-certs.patch index 67d199681f96..7750efbe0083 100644 --- a/pkgs/development/libraries/openssl/use-etc-ssl-certs.patch +++ b/pkgs/development/libraries/openssl/use-etc-ssl-certs.patch @@ -3,11 +3,11 @@ index 329ef62..9a8df64 100644 --- a/include/internal/cryptlib.h +++ b/include/internal/cryptlib.h @@ -56,7 +56,7 @@ DEFINE_LHASH_OF(MEM); - # ifndef OPENSSL_SYS_VMS - # define X509_CERT_AREA OPENSSLDIR - # define X509_CERT_DIR OPENSSLDIR "/certs" --# define X509_CERT_FILE OPENSSLDIR "/cert.pem" -+# define X509_CERT_FILE "/etc/ssl/certs/ca-certificates.crt" - # define X509_PRIVATE_DIR OPENSSLDIR "/private" - # define CTLOG_FILE OPENSSLDIR "/ct_log_list.cnf" - # else + #ifndef OPENSSL_SYS_VMS + #define X509_CERT_AREA OPENSSLDIR + #define X509_CERT_DIR OPENSSLDIR "/certs" +-#define X509_CERT_FILE OPENSSLDIR "/cert.pem" ++#define X509_CERT_FILE "/etc/ssl/certs/ca-certificates.crt" + #define X509_PRIVATE_DIR OPENSSLDIR "/private" + #define CTLOG_FILE OPENSSLDIR "/ct_log_list.cnf" + #else