diff options
| author | Marius Bakke <marius@gnu.org> | 2021-05-23 14:20:34 +0200 |
|---|---|---|
| committer | Marius Bakke <marius@gnu.org> | 2021-05-23 17:49:57 +0200 |
| commit | 250a216cdc2d5425ee0053f3e614d54e0fb6aa90 (patch) | |
| tree | 4b02c1e0b2829cf2c3f76c8466bc74eb1325dc8d /gnu/packages/tls.scm | |
| parent | dbcf2b61b1f48cbe84d51873f4e4de60897b914c (diff) | |
| download | guix-250a216cdc2d5425ee0053f3e614d54e0fb6aa90.tar guix-250a216cdc2d5425ee0053f3e614d54e0fb6aa90.tar.gz | |
gnu: OpenSSL: Replace with 1.1.1k [fixes CVE-2021-3449 and CVE-2021-3450].
* gnu/packages/tls.scm (openssl-1.1.1k): New variable.
(openssl)[replacement]: New field.
Diffstat (limited to 'gnu/packages/tls.scm')
| -rw-r--r-- | gnu/packages/tls.scm | 22 |
1 files changed, 21 insertions, 1 deletions
diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm index 1a4e3dc258..174438ad87 100644 --- a/gnu/packages/tls.scm +++ b/gnu/packages/tls.scm @@ -9,7 +9,7 @@ ;;; Copyright © 2016, 2017, 2018 Nikita <nikita@n0.is> ;;; Copyright © 2016 Hartmut Goebel <h.goebel@crazy-compilers.com> ;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net> -;;; Copyright © 2017, 2018, 2019, 2020 Marius Bakke <mbakke@fastmail.com> +;;; Copyright © 2017, 2018, 2019, 2020, 2021 Marius Bakke <marius@gnu.org> ;;; Copyright © 2017–2019, 2021 Tobias Geerinckx-Rice <me@tobias.gr> ;;; Copyright © 2017 Rutger Helling <rhelling@mykolab.com> ;;; Copyright © 2018 Clément Lassieur <clement@lassieur.org> @@ -289,6 +289,7 @@ required structures.") (package (name "openssl") (version "1.1.1j") + (replacement openssl-1.1.1k) (source (origin (method url-fetch) (uri (list (string-append "https://www.openssl.org/source/openssl-" @@ -422,6 +423,25 @@ required structures.") (license license:openssl) (home-page "https://www.openssl.org/"))) +;; Replacement package to fix CVE-2021-3449 and CVE-2021-3450. +(define openssl-1.1.1k + (package + (inherit openssl) + (version "1.1.1k") + (source (origin + (method url-fetch) + (uri (list (string-append "https://www.openssl.org/source/openssl-" + version ".tar.gz") + (string-append "ftp://ftp.openssl.org/source/" + "openssl-" version ".tar.gz") + (string-append "ftp://ftp.openssl.org/source/old/" + (string-trim-right version char-set:letter) + "/openssl-" version ".tar.gz"))) + (patches (search-patches "openssl-1.1-c-rehash-in.patch")) + (sha256 + (base32 + "1rdfzcrxy9y38wqdw5942vmdax9hjhgrprzxm42csal7p5shhal9")))))) + (define-public openssl-1.0 (package (inherit openssl) |