nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-01-18 19:03:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

polkit: fix CVE-2019-6133

Browse Source 
Jann Horn of Google found that Polkit doesn't properly check
if a process is already authenticated, which can lead to an
authentication reuse by a different user[0]. See also [1]

Closes #55391

[0]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1692
[1]: https://gitlab.freedesktop.org/polkit/polkit/issues/75
This commit is contained in:
worldofpeace 2019-02-07 17:23:05 -05:00
parent 91aeda1432
commit 7da64c9fbe
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
pkgs/development/libraries/polkit/default.nix
View File

@ -21,6 +21,12 @@ stdenv.mkDerivation rec {
};
patches = [
# CVE-2019-6133 - See: https://bugs.chromium.org/p/project-zero/issues/detail?id=1692
(fetchpatch {
url = "https://gitlab.freedesktop.org/polkit/polkit/commit/6cc6aafee135ba44ea748250d7d29b562ca190e3.patch";
name = "CVE-2019-6133.patch";
sha256 = "0jjlbjzqcz96xh6w3nv3ss9jl0hhrcd7jg4aa5advf08ibaj29r1";
})
# CVE-2018-19788 - high UID fixup
(fetchpatch {
url = "https://gitlab.freedesktop.org/polkit/polkit/commit/5230646dc6876ef6e27f57926b1bad348f636147.patch";