BoomMicrophone/nixpkgs-suyu
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #86417 from tokudan/p7zip-abandoned

Browse source 
p7zip: fix two CVEs and mark as insecure
This commit is contained in:
Florian Klink 2020-05-01 14:42:50 +02:00 committed by GitHub
commit d92d0c382e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 14 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
pkgs/tools/archivers/p7zip/default.nix
View file

@ -1,4 +1,4 @@
{ stdenv, fetchurl, lib, enableUnfree ? false }:
{ stdenv, fetchurl, fetchpatch, lib, enableUnfree ? false }:
stdenv.mkDerivation rec {
pname = "p7zip";
@ -12,6 +12,14 @@ stdenv.mkDerivation rec {
patches = [
./12-CVE-2016-9296.patch
./13-CVE-2017-17969.patch
(fetchpatch {
url = "https://raw.githubusercontent.com/termux/termux-packages/master/packages/p7zip/3-CVE-2018-5996.patch";
sha256 = "1zivvkazmza0653i498ccp3zbpbpc7dvxl3zxwllbx41b6n589yp";
})
(fetchpatch {
url = "https://raw.githubusercontent.com/termux/termux-packages/master/packages/p7zip/4-CVE-2018-10115.patch";
sha256 = "1cr7q8gnrk9yp6dcvxaqi1yhdbgp964nkv65ls41mw1kdfm44zn6";
})
];
# Default makefile is full of impurities on Darwin. The patch doesn't hurt Linux so I'm leaving it unconditional
@ -49,6 +57,11 @@ stdenv.mkDerivation rec {
description = "A port of the 7-zip archiver";
platforms = stdenv.lib.platforms.unix;
maintainers = [ stdenv.lib.maintainers.raskin ];
knownVulnerabilities = [
# p7zip is abandoned, according to this thread on its forums:
# https://sourceforge.net/p/p7zip/discussion/383043/thread/fa143cf2/#1817
"p7zip is abandoned and may not receive important security fixes"
];
# RAR code is under non-free UnRAR license, but we remove it
license = if enableUnfree then lib.licenses.unfree else lib.licenses.lgpl2Plus;
};