From 8c02e9a6903b26057f4b2bc20fd158b6989ec26b Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Fri, 3 May 2024 13:40:24 +0200 Subject: R: apply patch for CVE-2024-27322 https://hiddenlayer.com/research/r-bitrary-code-execution/ Patch has been identified by checking the SCM logs. I was not able to find another part of the patch. Fedora 39 went the same way in https://src.fedoraproject.org/rpms/R/c/b1a4e124f24f03916877bc116c1f9e89dd6c34a5?branch=f39 See also https://github.com/spack/spack/issues/43932 (cherry picked from commit 6a3601a1c654e27dc3a39e7732ed4b9972b8247f) --- pkgs/applications/science/math/R/default.nix | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/pkgs/applications/science/math/R/default.nix b/pkgs/applications/science/math/R/default.nix index f4cc1f1fbfeaa..a870eda88fcae 100644 --- a/pkgs/applications/science/math/R/default.nix +++ b/pkgs/applications/science/math/R/default.nix @@ -1,4 +1,4 @@ -{ lib, stdenv, fetchurl, bzip2, gfortran, libX11, libXmu, libXt, libjpeg, libpng +{ lib, stdenv, fetchurl, fetchpatch, bzip2, gfortran, libX11, libXmu, libXt, libjpeg, libpng , libtiff, ncurses, pango, pcre2, perl, readline, tcl, texlive, texliveSmall, tk, xz, zlib , less, texinfo, graphviz, icu, pkg-config, bison, imake, which, jdk, blas, lapack , curl, Cocoa, Foundation, libobjc, libcxx, tzdata @@ -37,6 +37,12 @@ stdenv.mkDerivation (finalAttrs: { patches = [ ./no-usr-local-search-paths.patch + (fetchpatch { + # https://hiddenlayer.com/research/r-bitrary-code-execution/ + name = "CVE-2024-27322.patch"; + url = "https://github.com/r-devel/r-svn/commit/f7c46500f455eb4edfc3656c3fa20af61b16abb7.patch"; + hash = "sha256-CH2mMmie9E96JeGSC7UGm7/roUNhK5xv6HO53N2ixEI="; + }) ]; # Test of the examples for package 'tcltk' fails in Darwin sandbox. See: -- cgit 1.4.1