aboutsummaryrefslogtreecommitdiff
path: root/gnu/packages/curl.scm
diff options
context:
space:
mode:
Diffstat (limited to 'gnu/packages/curl.scm')
-rw-r--r--gnu/packages/curl.scm11
1 files changed, 10 insertions, 1 deletions
diff --git a/gnu/packages/curl.scm b/gnu/packages/curl.scm
index 222910b655..46e0fa0f16 100644
--- a/gnu/packages/curl.scm
+++ b/gnu/packages/curl.scm
@@ -54,7 +54,16 @@
(inputs `(("gnutls" ,gnutls)
("gss" ,gss)
("libidn" ,libidn)
- ("libssh2" ,libssh2)
+
+ ;; XXX libssh2-1.4 is a temporary package for use only by curl,
+ ;; to allow most users of libssh2 to get the security update for
+ ;; CVE-2016-7087 while postponing the large number of rebuilds
+ ;; entailed by updating curl. Soon, curl should be updated to
+ ;; use the latest libssh2 and libssh2-1.4 should be removed.
+
+ ;; XXX libssh2-1.4 is vulnerable to CVE-2016-0787.
+ ("libssh2" ,libssh2-1.4)
+
("openldap" ,openldap)
("zlib" ,zlib)))
(native-inputs