From d345fb25003313c0af43f867c9b5660fdfcae59a Mon Sep 17 00:00:00 2001 From: Thiago Kenji Okada Date: Mon, 28 Nov 2022 11:42:27 +0000 Subject: [PATCH] python27: fix CVE-2021-3733 --- .../interpreters/python/cpython/2.7/default.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix index ebbae7381b01..684088186a0a 100644 --- a/pkgs/development/interpreters/python/cpython/2.7/default.nix +++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix @@ -79,6 +79,8 @@ let version = with sourceVersion; "${major}.${minor}.${patch}${suffix}"; + # ActiveState is a fork of cpython that includes fixes for security + # issues after its EOL src = fetchFromGitHub { owner = "ActiveState"; repo = "cpython"; @@ -121,6 +123,13 @@ let # Backport from CPython 3.8 of a good list of tests to run for PGO. ./profile-task.patch + # remove once 2.7.18.6 is released + (fetchpatch { + name = "CVE-2021-3733.patch"; + url = "https://github.com/ActiveState/cpython/commit/eeb7fe50450f08a782921f3229abed2f23e7b2d7.patch"; + sha256 = "sha256-ch4cMoFythDmyvlVxOAVw3Ow4PPWVDq5o9c1qox2824="; + }) + # The workaround is for unittests on Win64, which we don't support. # It does break aarch64-darwin, which we do support. See: # * https://bugs.python.org/issue35523