From eab028a911ddc4c2f896647349dd56db72389456 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Tue, 27 Jan 2026 19:06:32 +0100 Subject: [PATCH] openssl: 3.6.0 -> 3.6.1 The second item (severity: High) has possible unauthenticated RCE: https://www.openwall.com/lists/oss-security/2026/01/27/5 https://github.com/openssl/openssl/blob/openssl-3.6.1/CHANGES.md#openssl-36 The patches differ in whitespace only, as that's what upstream changed. --- .../openssl/3.5/use-etc-ssl-certs-darwin.patch | 13 ------------- .../libraries/openssl/3.5/use-etc-ssl-certs.patch | 13 ------------- .../openssl/3.6/use-etc-ssl-certs-darwin.patch | 13 +++++++++++++ .../libraries/openssl/3.6/use-etc-ssl-certs.patch | 13 +++++++++++++ pkgs/development/libraries/openssl/default.nix | 8 ++++---- 5 files changed, 30 insertions(+), 30 deletions(-) delete mode 100644 pkgs/development/libraries/openssl/3.5/use-etc-ssl-certs-darwin.patch delete mode 100644 pkgs/development/libraries/openssl/3.5/use-etc-ssl-certs.patch create mode 100644 pkgs/development/libraries/openssl/3.6/use-etc-ssl-certs-darwin.patch create mode 100644 pkgs/development/libraries/openssl/3.6/use-etc-ssl-certs.patch diff --git a/pkgs/development/libraries/openssl/3.5/use-etc-ssl-certs-darwin.patch b/pkgs/development/libraries/openssl/3.5/use-etc-ssl-certs-darwin.patch deleted file mode 100644 index e8b07b4ae599..000000000000 --- a/pkgs/development/libraries/openssl/3.5/use-etc-ssl-certs-darwin.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/include/internal/common.h b/include/internal/common.h -index 15666f1..d91e25b 100644 ---- a/include/internal/common.h -+++ b/include/internal/common.h -@@ -83,7 +83,7 @@ __owur static ossl_inline int ossl_assert_int(int expr, const char *exprstr, - # ifndef OPENSSL_SYS_VMS - # define X509_CERT_AREA OPENSSLDIR - # define X509_CERT_DIR OPENSSLDIR "/certs" --# define X509_CERT_FILE OPENSSLDIR "/cert.pem" -+# define X509_CERT_FILE "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt" - # define X509_PRIVATE_DIR OPENSSLDIR "/private" - # define CTLOG_FILE OPENSSLDIR "/ct_log_list.cnf" - # else diff --git a/pkgs/development/libraries/openssl/3.5/use-etc-ssl-certs.patch b/pkgs/development/libraries/openssl/3.5/use-etc-ssl-certs.patch deleted file mode 100644 index 13a36fbcd031..000000000000 --- a/pkgs/development/libraries/openssl/3.5/use-etc-ssl-certs.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/include/internal/common.h b/include/internal/common.h -index 15666f1..d91e25b 100644 ---- a/include/internal/common.h -+++ b/include/internal/common.h -@@ -83,7 +83,7 @@ __owur static ossl_inline int ossl_assert_int(int expr, const char *exprstr, - # ifndef OPENSSL_SYS_VMS - # define X509_CERT_AREA OPENSSLDIR - # define X509_CERT_DIR OPENSSLDIR "/certs" --# define X509_CERT_FILE OPENSSLDIR "/cert.pem" -+# define X509_CERT_FILE "/etc/ssl/certs/ca-certificates.crt" - # define X509_PRIVATE_DIR OPENSSLDIR "/private" - # define CTLOG_FILE OPENSSLDIR "/ct_log_list.cnf" - # else diff --git a/pkgs/development/libraries/openssl/3.6/use-etc-ssl-certs-darwin.patch b/pkgs/development/libraries/openssl/3.6/use-etc-ssl-certs-darwin.patch new file mode 100644 index 000000000000..bb2d048542cb --- /dev/null +++ b/pkgs/development/libraries/openssl/3.6/use-etc-ssl-certs-darwin.patch @@ -0,0 +1,13 @@ +diff --git a/include/internal/common.h b/include/internal/common.h +index 15666f1..d91e25b 100644 +--- a/include/internal/common.h ++++ b/include/internal/common.h +@@ -83,7 +83,7 @@ __owur static ossl_inline int ossl_assert_int(int expr, const char *exprstr, + #ifndef OPENSSL_SYS_VMS + #define X509_CERT_AREA OPENSSLDIR + #define X509_CERT_DIR OPENSSLDIR "/certs" +-#define X509_CERT_FILE OPENSSLDIR "/cert.pem" ++#define X509_CERT_FILE "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt" + #define X509_PRIVATE_DIR OPENSSLDIR "/private" + #define CTLOG_FILE OPENSSLDIR "/ct_log_list.cnf" + #else diff --git a/pkgs/development/libraries/openssl/3.6/use-etc-ssl-certs.patch b/pkgs/development/libraries/openssl/3.6/use-etc-ssl-certs.patch new file mode 100644 index 000000000000..e0fb994161de --- /dev/null +++ b/pkgs/development/libraries/openssl/3.6/use-etc-ssl-certs.patch @@ -0,0 +1,13 @@ +diff --git a/include/internal/common.h b/include/internal/common.h +index 15666f1..d91e25b 100644 +--- a/include/internal/common.h ++++ b/include/internal/common.h +@@ -83,7 +83,7 @@ __owur static ossl_inline int ossl_assert_int(int expr, const char *exprstr, + #ifndef OPENSSL_SYS_VMS + #define X509_CERT_AREA OPENSSLDIR + #define X509_CERT_DIR OPENSSLDIR "/certs" +-#define X509_CERT_FILE OPENSSLDIR "/cert.pem" ++#define X509_CERT_FILE "/etc/ssl/certs/ca-certificates.crt" + #define X509_PRIVATE_DIR OPENSSLDIR "/private" + #define CTLOG_FILE OPENSSLDIR "/ct_log_list.cnf" + #else diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix index 3ce6b0acb111..24b68a768117 100644 --- a/pkgs/development/libraries/openssl/default.nix +++ b/pkgs/development/libraries/openssl/default.nix @@ -459,8 +459,8 @@ in }; openssl_3_6 = common { - version = "3.6.0"; - hash = "sha256-tqX0S362nj+jXb8VUkQFtEg3pIHUPYHa3d4/8h/LuOk="; + version = "3.6.1"; + hash = "sha256-sb/tzVson/Iq7ofJ1gD1FXZ+v0X3cWjLbWTyMfUYqC4="; patches = [ # Support for NIX_SSL_CERT_FILE, motivation: @@ -474,9 +474,9 @@ in # Look up SSL certificates in /etc rather than the immutable installation directory ( if stdenv.hostPlatform.isDarwin then - ./3.5/use-etc-ssl-certs-darwin.patch + ./3.6/use-etc-ssl-certs-darwin.patch else - ./3.5/use-etc-ssl-certs.patch + ./3.6/use-etc-ssl-certs.patch ) ] ++ lib.optionals stdenv.hostPlatform.isMinGW [