From 5cdcd3fef4705fb24a89b5ff13812b87b9e4c5c8 Mon Sep 17 00:00:00 2001 From: Andreas Rammhold Date: Sat, 3 Feb 2018 16:11:30 +0100 Subject: [PATCH 1/3] squid4: 4.0.21 -> 4.0.23 (fixes CVE-2018-1000024 & CVE-2018-1000027) --- pkgs/servers/squid/4.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/squid/4.nix b/pkgs/servers/squid/4.nix index f0429475be2..62f0b7c001b 100644 --- a/pkgs/servers/squid/4.nix +++ b/pkgs/servers/squid/4.nix @@ -2,11 +2,11 @@ , expat, libxml2, openssl }: stdenv.mkDerivation rec { - name = "squid-4.0.21"; + name = "squid-4.0.23"; src = fetchurl { url = "http://www.squid-cache.org/Versions/v4/${name}.tar.xz"; - sha256 = "0cwfj3qpl72k5l1h2rvkv1xg0720rifk4wcvi49z216hznyqwk8m"; + sha256 = "0a8g0zs3xayfkxl8maq823b14lckvh9d5lf7ryh9rx303xh1mdqq"; }; buildInputs = [ From 291b05ee21a6b822e999566febf9e419e45936da Mon Sep 17 00:00:00 2001 From: Andreas Rammhold Date: Wed, 7 Feb 2018 11:37:30 +0100 Subject: [PATCH 2/3] squid4: hack to detect our libxml2 --- pkgs/servers/squid/4.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/servers/squid/4.nix b/pkgs/servers/squid/4.nix index 62f0b7c001b..4a4502a6939 100644 --- a/pkgs/servers/squid/4.nix +++ b/pkgs/servers/squid/4.nix @@ -13,6 +13,10 @@ stdenv.mkDerivation rec { perl openldap db cyrus_sasl expat libxml2 openssl ] ++ stdenv.lib.optionals stdenv.isLinux [ libcap pam ]; + prePatch = '' + substituteInPlace configure --replace "/usr/local/include/libxml2" "${libxml2.dev}/include/libxml2" + ''; + configureFlags = [ "--enable-ipv6" "--disable-strict-error-checking" From ea817d7b6fa0d0cf4644973d7cf89ad4e23d2f6a Mon Sep 17 00:00:00 2001 From: Andreas Rammhold Date: Sun, 4 Feb 2018 09:29:08 +0100 Subject: [PATCH 3/3] squid: fix CVE-2018-1000024 & CVE-2018-1000027 --- pkgs/servers/squid/default.nix | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/pkgs/servers/squid/default.nix b/pkgs/servers/squid/default.nix index 7f1c97bd642..95f4233df10 100644 --- a/pkgs/servers/squid/default.nix +++ b/pkgs/servers/squid/default.nix @@ -1,4 +1,4 @@ -{ stdenv, fetchurl, perl, openldap, pam, db, cyrus_sasl, libcap +{ stdenv, fetchurl, fetchpatch, perl, openldap, pam, db, cyrus_sasl, libcap , expat, libxml2, openssl }: stdenv.mkDerivation rec { @@ -13,6 +13,19 @@ stdenv.mkDerivation rec { perl openldap db cyrus_sasl expat libxml2 openssl ] ++ stdenv.lib.optionals stdenv.isLinux [ libcap pam ]; + patches = [ + (fetchpatch { + name = "CVE-2018-1000024.patch"; + url = http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2018_1.patch; + sha256 = "0vzxr4rmybz0w4c1hi3szvqawbzl4r4b8wyvq9vgq1mzkk5invpg"; + }) + (fetchpatch { + name = "CVE-2018-1000027.patch"; + url = http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2018_2.patch; + sha256 = "1a8hwk9z7h1j0c57anfzp3bwjd4pjbyh8aks4ca79nwz4d0y6wf3"; + }) + ]; + configureFlags = [ "--enable-ipv6" "--disable-strict-error-checking"