From e4767b4727589567da29a90a71947c2bdbe43988 Mon Sep 17 00:00:00 2001 From: Emily Date: Wed, 14 Aug 2024 15:15:25 +0100 Subject: [PATCH 1/2] olm: mark as vulnerable See . --- pkgs/development/libraries/olm/default.nix | 39 ++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/pkgs/development/libraries/olm/default.nix b/pkgs/development/libraries/olm/default.nix index bb7553c2eb3e..f95574198710 100644 --- a/pkgs/development/libraries/olm/default.nix +++ b/pkgs/development/libraries/olm/default.nix @@ -27,5 +27,44 @@ stdenv.mkDerivation rec { homepage = "https://gitlab.matrix.org/matrix-org/olm"; license = licenses.asl20; maintainers = with maintainers; [ tilpner oxzi ]; + knownVulnerabilities = [ '' + The libolm end‐to‐end encryption library used in many Matrix + clients and Jitsi Meet has been deprecated upstream, and relies + on a cryptography library that has known side‐channel issues and + disclaims that its implementations are not cryptographically secure + and should not be used when cryptographic security is required. + + It is not known that the issues can be exploited over the network in + practical conditions. Upstream has stated that the library should + not be used going forwards, and there are no plans to move to a + another cryptography implementation or otherwise further maintain + the library at all. + + You should make an informed decision about whether to override this + security warning, especially if you critically rely on end‐to‐end + encryption. If you don’t care about that, or don’t use the Matrix + functionality of a multi‐protocol client depending on libolm, + then there should be no additional risk. + + Some clients are investigating migrating away from libolm to maintained + libraries without known vulnerabilities. + + For further information, see: + + * The libolm deprecation notice: + + + * The warning from the cryptography code used by libolm: + + + * The blog post disclosing the details of the known vulnerabilities: + + + * The Matrix.org project lead’s response to the disclosure: + + + * A (likely incomplete) aggregation of client tracking issue links: + + '' ]; }; } From bbfd5d10851a4953301e0373d8749b8fe41bc31f Mon Sep 17 00:00:00 2001 From: Emily Date: Wed, 14 Aug 2024 15:15:25 +0100 Subject: [PATCH 2/2] {cinny-unwrapped,element-call,fluffychat,jitsi-meet}: inherit vulnerabilities from olm These vendor the libolm code. --- .../networking/instant-messengers/fluffychat/default.nix | 2 ++ pkgs/by-name/ci/cinny-unwrapped/package.nix | 2 ++ pkgs/by-name/el/element-call/package.nix | 2 ++ pkgs/servers/web-apps/jitsi-meet/default.nix | 3 ++- 4 files changed, 8 insertions(+), 1 deletion(-) diff --git a/pkgs/applications/networking/instant-messengers/fluffychat/default.nix b/pkgs/applications/networking/instant-messengers/fluffychat/default.nix index 5d4978783785..666cda55472e 100644 --- a/pkgs/applications/networking/instant-messengers/fluffychat/default.nix +++ b/pkgs/applications/networking/instant-messengers/fluffychat/default.nix @@ -8,6 +8,7 @@ , pulseaudio , makeDesktopItem , zenity +, olm , targetFlutterPlatform ? "linux" }: @@ -44,6 +45,7 @@ flutter319.buildFlutterApplication (rec { maintainers = with maintainers; [ mkg20001 gilice ]; platforms = [ "x86_64-linux" "aarch64-linux" ]; sourceProvenance = [ sourceTypes.fromSource ]; + inherit (olm.meta) knownVulnerabilities; }; } // lib.optionalAttrs (targetFlutterPlatform == "linux") { nativeBuildInputs = [ imagemagick ]; diff --git a/pkgs/by-name/ci/cinny-unwrapped/package.nix b/pkgs/by-name/ci/cinny-unwrapped/package.nix index da90e7b940ed..63f4d84649c6 100644 --- a/pkgs/by-name/ci/cinny-unwrapped/package.nix +++ b/pkgs/by-name/ci/cinny-unwrapped/package.nix @@ -9,6 +9,7 @@ pango, stdenv, darwin, + olm, }: buildNpmPackage rec { @@ -54,5 +55,6 @@ buildNpmPackage rec { maintainers = with lib.maintainers; [ abbe ]; license = lib.licenses.agpl3Only; platforms = lib.platforms.all; + inherit (olm.meta) knownVulnerabilities; }; } diff --git a/pkgs/by-name/el/element-call/package.nix b/pkgs/by-name/el/element-call/package.nix index 835329fef295..8f9e27b3a9b3 100644 --- a/pkgs/by-name/el/element-call/package.nix +++ b/pkgs/by-name/el/element-call/package.nix @@ -6,6 +6,7 @@ , yarnBuildHook , nodejs , npmHooks +, olm }: let @@ -52,5 +53,6 @@ stdenv.mkDerivation (finalAttrs: { license = licenses.asl20; maintainers = with maintainers; [ kilimnik ]; mainProgram = "element-call"; + inherit (olm.meta) knownVulnerabilities; }; }) diff --git a/pkgs/servers/web-apps/jitsi-meet/default.nix b/pkgs/servers/web-apps/jitsi-meet/default.nix index f1097aeb1aec..32d7249ffc6a 100644 --- a/pkgs/servers/web-apps/jitsi-meet/default.nix +++ b/pkgs/servers/web-apps/jitsi-meet/default.nix @@ -1,4 +1,4 @@ -{ lib, stdenv, fetchurl, nixosTests }: +{ lib, stdenv, fetchurl, nixosTests, olm }: stdenv.mkDerivation rec { pname = "jitsi-meet"; @@ -34,5 +34,6 @@ stdenv.mkDerivation rec { license = licenses.asl20; maintainers = teams.jitsi.members; platforms = platforms.all; + inherit (olm.meta) knownVulnerabilities; }; }