From 8d5ceb120d34eab6ab557a82af9d4cd594dc35b7 Mon Sep 17 00:00:00 2001 From: Mark H Weaver Date: Fri, 26 Feb 2016 21:55:52 -0500 Subject: gnu: curl: Use updated libssh2 [fixes CVE-2016-7087]. * gnu/packages/curl.scm (curl)[inputs]: Use libssh2. * gnu/packages/ssh.scm (libssh2-1.4): Remove variable. --- gnu/packages/ssh.scm | 18 ------------------ 1 file changed, 18 deletions(-) (limited to 'gnu/packages/ssh.scm') diff --git a/gnu/packages/ssh.scm b/gnu/packages/ssh.scm index 081c7cbe32..1b4a4b4777 100644 --- a/gnu/packages/ssh.scm +++ b/gnu/packages/ssh.scm @@ -112,24 +112,6 @@ a server that supports the SSH-2 protocol.") (license license:bsd-3) (home-page "http://www.libssh2.org/"))) -;;; XXX This is a temporary package for use only by curl, to allow most users -;;; of libssh2 to get the security update sooner while postponing the large -;;; number of rebuilds entailed by updating curl. -;;; -;;; XXX This package is vulnerable to CVE-2016-7087. -;;; -;;; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0787 -(define-public libssh2-1.4 - (package (inherit libssh2) - (version "1.4.3") - (source (origin - (method url-fetch) - (uri (string-append "https://www.libssh2.org/download/libssh2-" - version ".tar.gz")) - (sha256 - (base32 - "0vdr478dbhbdgnniqmirawjb7mrcxckn4slhhrijxnzrkmgziipa")))))) - (define-public openssh (package (name "openssh") -- cgit v1.2.3