From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:470:142:3::10]:37786) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1hgx1a-00028f-UW for guix-patches@gnu.org; Fri, 28 Jun 2019 15:59:13 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hgx1U-0001ky-IN for guix-patches@gnu.org; Fri, 28 Jun 2019 15:59:07 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:57766) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1hgx1S-0001jJ-24 for guix-patches@gnu.org; Fri, 28 Jun 2019 15:59:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1hgx1R-0008Q7-V9 for guix-patches@gnu.org; Fri, 28 Jun 2019 15:59:02 -0400 Subject: [bug#36424] gnu: expat: Replace with 2.2.7 [security fixes] References: In-Reply-To: Resent-Message-ID: Date: Fri, 28 Jun 2019 15:57:58 -0400 (EDT) From: Jack Hill Message-ID: MIME-Version: 1.0 Content-Type: multipart/mixed; BOUNDARY="925712948-1133735364-1561751878=:17508" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+kyle=kyleam.com@gnu.org Sender: "Guix-patches" To: 36424@debbugs.gnu.org This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. --925712948-1133735364-1561751878=:17508 Content-Type: text/plain; format=flowed; charset=ISO-8859-15 Content-Transfer-Encoding: 8BIT >From 6db23c61704686016a57fb9557240dd83a79bea6 Mon Sep 17 00:00:00 2001 From: Jack Hill Date: Fri, 28 Jun 2019 15:47:35 -0400 This fixes CVE-2018-20843. * gnu/packages/xml.scm (expat)[replacement]: New field. (expat-2.2.7): New public variable. --- gnu/packages/xml.scm | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/gnu/packages/xml.scm b/gnu/packages/xml.scm index fc60758724..1be2a58d2e 100644 --- a/gnu/packages/xml.scm +++ b/gnu/packages/xml.scm @@ -20,6 +20,7 @@ ;;; Copyright © 2017 Petter ;;; Copyright © 2017 Stefan Reichör ;;; Copyright © 2018 Pierre Neidhardt +;;; Copyright © 2019 Jack Hill ;;; ;;; This file is part of GNU Guix. ;;; @@ -65,6 +66,7 @@ (define-public expat (package (name "expat") + (replacement expat-2.2.7) (version "2.2.6") (source (origin (method url-fetch) @@ -82,6 +84,21 @@ stream-oriented parser in which an application registers handlers for things the parser might find in the XML document (like start tags).") (license license:expat))) +(define-public expat-2.2.7 + (let ((dot->underscore (lambda (c) (if (equal? #\. c) #\_ c)))) + (package + (inherit expat) + (version "2.2.7") + (source + (origin + (method url-fetch) + (uri (string-append "https://github.com/libexpat/libexpat/releases/download/R_" + (string-map dot->underscore version) + "/expat-" version ".tar.xz")) + (sha256 + (base32 + "1y5yax6bq8p9xk49zqkd62pxk8bq266wrgbrqgaxp3wsrw5g9qrh"))))))) + (define-public libebml (package (name "libebml") -- 2.22.0 --925712948-1133735364-1561751878=:17508--