diff options
| author | Thomas Gerbet <thomas@gerbet.me> | 2024-05-03 13:40:24 +0200 |
|---|---|---|
| committer | github-actions[bot] <github-actions[bot]@users.noreply.github.com> | 2024-05-03 13:54:27 +0000 |
| commit | 8c02e9a6903b26057f4b2bc20fd158b6989ec26b (patch) | |
| tree | 0379130a9016747a3df69fe1f4a72d08af0fdbfd | |
| parent | 5771c2f0e8998292d31e54430740d96c79fae164 (diff) | |
R: apply patch for CVE-2024-27322
https://hiddenlayer.com/research/r-bitrary-code-execution/ Patch has been identified by checking the SCM logs. I was not able to find another part of the patch. Fedora 39 went the same way in https://src.fedoraproject.org/rpms/R/c/b1a4e124f24f03916877bc116c1f9e89dd6c34a5?branch=f39 See also https://github.com/spack/spack/issues/43932 (cherry picked from commit 6a3601a1c654e27dc3a39e7732ed4b9972b8247f)
| -rw-r--r-- | pkgs/applications/science/math/R/default.nix | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/pkgs/applications/science/math/R/default.nix b/pkgs/applications/science/math/R/default.nix index f4cc1f1fbfea..a870eda88fca 100644 --- a/pkgs/applications/science/math/R/default.nix +++ b/pkgs/applications/science/math/R/default.nix @@ -1,4 +1,4 @@ -{ lib, stdenv, fetchurl, bzip2, gfortran, libX11, libXmu, libXt, libjpeg, libpng +{ lib, stdenv, fetchurl, fetchpatch, bzip2, gfortran, libX11, libXmu, libXt, libjpeg, libpng , libtiff, ncurses, pango, pcre2, perl, readline, tcl, texlive, texliveSmall, tk, xz, zlib , less, texinfo, graphviz, icu, pkg-config, bison, imake, which, jdk, blas, lapack , curl, Cocoa, Foundation, libobjc, libcxx, tzdata @@ -37,6 +37,12 @@ stdenv.mkDerivation (finalAttrs: { patches = [ ./no-usr-local-search-paths.patch + (fetchpatch { + # https://hiddenlayer.com/research/r-bitrary-code-execution/ + name = "CVE-2024-27322.patch"; + url = "https://github.com/r-devel/r-svn/commit/f7c46500f455eb4edfc3656c3fa20af61b16abb7.patch"; + hash = "sha256-CH2mMmie9E96JeGSC7UGm7/roUNhK5xv6HO53N2ixEI="; + }) ]; # Test of the examples for package 'tcltk' fails in Darwin sandbox. See: |