nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-11-26 17:03:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

znc: fix modtcl rce

Browse Source 
ZNC's modtcl fails to properly escape certain IRC events, which allows
executing code within that ZNC instance, when the module is loaded.

Fixes: CVE-2024-39844
This commit is contained in:
Martin Weinelt 2024-07-03 17:52:50 +02:00
parent 366e022106
commit eed6707798
No known key found for this signature in database
GPG Key ID: 87C1E9888F856759
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
pkgs/applications/networking/znc/default.nix
View File

@ -1,4 +1,4 @@
{ lib, stdenv, fetchurl, openssl, pkg-config
{ lib, stdenv, fetchurl, fetchpatch2, openssl, pkg-config
, withPerl ? false, perl
, withPython ? false, python3
, withTcl ? false, tcl
@ -18,6 +18,14 @@ stdenv.mkDerivation rec {
sha256 = "03fyi0j44zcanj1rsdx93hkdskwfvhbywjiwd17f9q1a7yp8l8zz";
};
patches = [
(fetchpatch2 {
name = "CVE-2024-39844.patch";
url = "https://people.znc.in/~darthgandalf/dir/ymQgfvwiG54pPFqyv1U0pcvvj5PLz5.txt";
hash = "sha256-+WPlErDI4AR3UZL3P8IitFop1MBEa97pro57pr0/TZw=";
})
];
nativeBuildInputs = [ pkg-config ];
buildInputs = [ openssl ]