From e8d6be7a4b4f2db04ac013731260994a48de81d2 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Wed, 26 Apr 2023 13:37:31 +0200 Subject: [PATCH] =?UTF-8?q?xen:=20mark=20EOL=20=E2=89=A4=204.15,=20add=20k?= =?UTF-8?q?nown=20CVEs=20in=20nixpkgs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Currently, Xen is very unmaintained, as this is a particularly complex piece of software that touts itself as secure, we are not doing a service to Xen by packaging unsecure piece of their software. Let's be brutally honest about the state of things in nixpkgs. --- pkgs/applications/virtualization/xen/generic.nix | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/virtualization/xen/generic.nix b/pkgs/applications/virtualization/xen/generic.nix index 8a687d45e28c..dd84f642e32d 100644 --- a/pkgs/applications/virtualization/xen/generic.nix +++ b/pkgs/applications/virtualization/xen/generic.nix @@ -244,10 +244,21 @@ stdenv.mkDerivation (rec { + "\nIncludes:\n" + withXenfiles (name: x: "* ${name}: ${x.meta.description or "(No description)"}."); platforms = [ "x86_64-linux" ]; - maintainers = with lib.maintainers; [ eelco oxij ]; + maintainers = [ ]; license = lib.licenses.gpl2; + knownVulnerabilities = [ + # https://www.openwall.com/lists/oss-security/2023/03/21/1 + # Affects 3.2 (at *least*) - 4.17 + "CVE-2022-42332" + # https://www.openwall.com/lists/oss-security/2023/03/21/2 + # Affects 4.11 - 4.17 + "CVE-2022-42333" + "CVE-2022-42334" + # https://www.openwall.com/lists/oss-security/2023/03/21/3 + # Affects 4.15 - 4.17 + "CVE-2022-42331" # https://xenbits.xen.org/docs/unstable/support-matrix.html - knownVulnerabilities = lib.optionals (lib.versionOlder version "4.13") [ + ] ++ lib.optionals (lib.versionOlder version "4.15") [ "This version of Xen has reached its end of life. See https://xenbits.xen.org/docs/unstable/support-matrix.html" ]; } // (config.meta or {});