[19.09] Revert 1.1.1e update and apply CVE-2019-1551 patch #82928
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This reverts commit 41f1484. openssl 1.1.1e introduces breaking changes in its EOF handling.
|
@GrahamcOfBorg build python3Packages.pyopenssl |
KamilaBorowska
force-pushed
the
apply-cve-2019-1551-patch
branch
from
de4ddcc to
ea6f79c
Compare
Not upgrading to 1.1.1e because this version introduces breaking changes, in particular changes the error on EOF.
KamilaBorowska
force-pushed
the
apply-cve-2019-1551-patch
branch
from
ea6f79c to
4e7cded
Compare
10 tasks
|
@ckauhaus this should also get a security-label |
|
I agree with this PR, except for tiny bits:
(and I pushed that) In any case, this CVE is rather low severity – upstream even didn't bother to release a new 1.1.1 for months after publishing a fix. |
vcunat
added a commit
that referenced
this pull request
Mar 21, 2020
fetchpatch can't be used here and fetchurl from GitHub like in PR #82928 has the risk of breaking the hash later; fortunately the patches aren't too large.
10 tasks
flokli
pushed a commit
to flokli/nixpkgs
that referenced
this pull request
Apr 2, 2020
fetchpatch can't be used here and fetchurl from GitHub like in PR NixOS#82928 has the risk of breaking the hash later; fortunately the patches aren't too large. (cherry picked from commit 2071e3b)
10 tasks
flokli
pushed a commit
to flokli/nixpkgs
that referenced
this pull request
Apr 2, 2020
fetchpatch can't be used here and fetchurl from GitHub like in PR NixOS#82928 has the risk of breaking the hash later; fortunately the patches aren't too large. (cherry picked from commit 2071e3b)
stigok
pushed a commit
to stigok/nixpkgs
that referenced
this pull request
Jun 12, 2020
fetchpatch can't be used here and fetchurl from GitHub like in PR NixOS#82928 has the risk of breaking the hash later; fortunately the patches aren't too large. (cherry picked from commit 2071e3b)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation for this change
openssl 1.1.1e introduces breaking changes in its EOF handling. Applying only the security patch and nothing else to avoid risk of breakage.
Submitting to release-19.09 not staging-19.09, because it's broken anyway. Not submitting to other branches because I think the other branches should simply use 1.1.1e instead of bothering with patching process.
Things done
sandboxinnix.confon non-NixOS linux)pyopenssl, but I'm not going to rebuild the whole world)nix-shell -p nixpkgs-review --run "nixpkgs-review wip"./result/bin/)nix path-info -Sbefore and after)