diff options
| author | Marius Bakke <marius@gnu.org> | 2021-05-23 14:22:16 +0200 |
|---|---|---|
| committer | Leo Famulari <leo@famulari.name> | 2021-06-02 17:07:15 -0400 |
| commit | 6d71f6a73cd27d61d3302b9658893428af6314d2 (patch) | |
| tree | b8d301c60f733a11ce0f51b20280f79d426e8bff | |
| parent | f32e6e1e2cab0dea2947c1c1475e870f631e1bf6 (diff) | |
| download | guix-6d71f6a73cd27d61d3302b9658893428af6314d2.tar.gz | |
gnu: expat: Replace with 2.4.1 [fixes CVE-2013-0340].
* gnu/packages/xml.scm (expat-2.4.1): New variable. (expat)[replacement]: New field. Co-authored-by: Leo Famulari <leo@famulari.name>
| -rw-r--r-- | gnu/packages/xml.scm | 21 |
1 files changed, 20 insertions, 1 deletions
diff --git a/gnu/packages/xml.scm b/gnu/packages/xml.scm index ad2e3ec6c9..9743086b1e 100644 --- a/gnu/packages/xml.scm +++ b/gnu/packages/xml.scm @@ -13,7 +13,7 @@ ;;; Copyright © 2016 Jan Nieuwenhuizen <janneke@gnu.org> ;;; Copyright © 2016, 2017 Nikita <nikita@n0.is> ;;; Copyright © 2016–2021 Tobias Geerinckx-Rice <me@tobias.gr> -;;; Copyright © 2016, 2017, 2018, 2019, 2020 Marius Bakke <mbakke@fastmail.com> +;;; Copyright © 2016, 2017, 2018, 2019, 2020, 2021 Marius Bakke <marius@gnu.org> ;;; Copyright © 2017 Adriano Peluso <catonano@gmail.com> ;;; Copyright © 2017 Gregor Giesen <giesen@zaehlwerk.net> ;;; Copyright © 2017 Alex Vong <alexvong1995@gmail.com> @@ -121,6 +121,7 @@ the entire document.") (package (name "expat") (version "2.2.9") + (replacement expat-2.4.1) (source (let ((dot->underscore (lambda (c) (if (char=? #\. c) #\_ c)))) (origin (method url-fetch) @@ -144,6 +145,24 @@ stream-oriented parser in which an application registers handlers for things the parser might find in the XML document (like start tags).") (license license:expat))) +;; Replacement package to fix CVE-2013-0340. +(define expat-2.4.1 + (package + (inherit expat) + (version "2.4.1") + (source (let ((dot->underscore (lambda (c) (if (char=? #\. c) #\_ c)))) + (origin + (method url-fetch) + (uri (list (string-append "mirror://sourceforge/expat/expat/" + version "/expat-" version ".tar.xz") + (string-append + "https://github.com/libexpat/libexpat/releases/download/R_" + (string-map dot->underscore version) + "/expat-" version ".tar.xz"))) + (sha256 + (base32 + "0spvyb9d3hijs4ys3x64cfmilsynl8kv6clfahv8d4lvp86js0yg"))))))) + (define-public libebml (package (name "libebml") |