Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

gnupg: 2.3.4 -> 2.3.6, patch for CVE-2022-34903 #176598

Merged
merged 2 commits into from
Jul 3, 2022
Merged

gnupg: 2.3.4 -> 2.3.6, patch for CVE-2022-34903 #176598

merged 2 commits into from
Jul 3, 2022

Conversation

stigtsp
Copy link
Member

@stigtsp stigtsp commented Jun 6, 2022 •
edited
Loading

Description of changes

Update gnupg to 2.3.6
https://lists.gnu.org/archive/html/info-gnu/2022-04/msg00014.html

Add patch for CVE-2022-34903
https://dev.gnupg.org/rG34c649b3601383cd11dbc76221747ec16fd68e1b

Things done
  • Built on platform(s)
    • x86_64-linux
    • aarch64-linux
    • x86_64-darwin
    • aarch64-darwin
  • For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
  • Tested, as applicable:
  • Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
  • Tested basic functionality of all binary files (usually in ./result/bin/)
  • 22.11 Release Notes (or backporting 22.05 Release notes)
    • (Package updates) Added a release notes entry if the change is major or breaking
    • (Module updates) Added a release notes entry if the change is significant
    • (Module addition) Added a release notes entry if adding a new NixOS module
    • (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes
  • Fits CONTRIBUTING.md.

@stigtsp
Copy link
Member Author

stigtsp commented Jun 6, 2022

@GrahamcOfBorg build gnupg

@ofborg ofborg bot requested review from fpletz and vrthra June 6, 2022 18:45
@stigtsp stigtsp changed the base branch from master to staging June 8, 2022 15:50
@stigtsp
Copy link
Member Author

stigtsp commented Jun 8, 2022

@GrahamcOfBorg build gnupg

@alyssais
Copy link
Member

What's the status here? A GnuPG vulnerability has just been disclosed, and the patch doesn't apply cleanly to 2.3.4, so it would be great to get this in.

@stigtsp stigtsp marked this pull request as ready for review June 30, 2022 10:36
@stigtsp stigtsp requested a review from alyssais June 30, 2022 10:37
@stigtsp
Copy link
Member Author

stigtsp commented Jun 30, 2022 •
edited
Loading

What's the status here? A GnuPG vulnerability has just been disclosed, and the patch doesn't apply cleanly to 2.3.4, so it would be great to get this in.

I believe this is ready to go, will test a bit today with TPM2 and smart cards.

(I've not verified that all patches still are relevant though)

@stigtsp
Copy link
Member Author

stigtsp commented Jun 30, 2022

@GrahamcOfBorg build gnupg

fpletz
fpletz approved these changes Jul 1, 2022
View reviewed changes
Copy link
Member

@fpletz fpletz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The 2.3.5 changelog also doesn't indicate any obvious breakages: https://lists.gnupg.org/pipermail/gnupg-announce/2022q2/000472.html

@alyssais alyssais changed the base branch from staging to staging-next July 1, 2022 21:13
@alyssais
Copy link
Member

alyssais commented Jul 1, 2022

Retargeted to staging next since I think the aforementioned vuln needs to be fixed and this makes sense as a prerequisitie.

@vcunat
Copy link
Member

vcunat commented Jul 2, 2022

So perhaps even include the patch in this PR, so that we don't rebuild everything twice on staging-next?

@stigtsp
Copy link
Member Author

stigtsp commented Jul 3, 2022

The vulnerability has been assigned CVE-2022-34903, added patch from https://dev.gnupg.org/rG34c649b3601383cd11dbc76221747ec16fd68e1b

@ofborg ofborg bot requested a review from fpletz July 3, 2022 01:57
@stigtsp stigtsp changed the title gnupg: 2.3.4 -> 2.3.6 gnupg: 2.3.4 -> 2.3.6, patch for CVE-2022-34903 Jul 3, 2022
@vcunat vcunat merged commit f42d2ff into NixOS:staging-next Jul 3, 2022
@stigtsp stigtsp mentioned this pull request Jul 6, 2022
Merged
13 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@alyssais alyssais alyssais approved these changes

@vrthra vrthra Awaiting requested review from vrthra

@fpletz fpletz Awaiting requested review from fpletz

Assignees
No one assigned
Labels
1.severity: security 10.rebuild-darwin: 101-500 10.rebuild-linux: 501+ 10.rebuild-linux: 5001+
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@stigtsp @alyssais @vcunat @fpletz