From 3fb6b023460c60651ea1a39f19608e47068153be Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 3 May 2022 18:05:26 +0200 Subject: [PATCH] openssl_3_0: 3.0.2 -> 3.0.3 - The c_rehash script allows command injection (CVE-2022-1292) - OCSP_basic_verify may incorrectly verify the response signing certificate (CVE-2022-1343) - Incorrect MAC key used in the RC4-MD5 ciphersuite (CVE-2022-1434) - Resource leakage when decoding certificates and keys (CVE-2022-1473) https://mta.openssl.org/pipermail/openssl-announce/2022-May/000224.html Fixes: CVE-2022-1292, CVE-2022-1343, CVE-2022-1434, CVE-2022-1473 (cherry picked from commit c62eceb91e5b463974fca2bcedf033ae1f6c52db) --- pkgs/development/libraries/openssl/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix index d702a9267679e..d0bf9e5c8f5ba 100644 --- a/pkgs/development/libraries/openssl/default.nix +++ b/pkgs/development/libraries/openssl/default.nix @@ -205,8 +205,8 @@ in { }; openssl_3_0 = common { - version = "3.0.2"; - sha256 = "sha256-mOkczq1NR1auPJzeXgkZGo5YbZ9NUIOOfsCdZBHf22M="; + version = "3.0.3"; + sha256 = "sha256-7gB4rc7x3l8APGLIDMllJ3IWCcbzu0K3eV3zH4tVjAs="; patches = [ ./3.0/nix-ssl-cert-file.patch