Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: NixOS/nixpkgs
base: 3f541d1e7fad
Choose a base ref
...
head repository: NixOS/nixpkgs
compare: d5f340f59e63
Choose a head ref
  • 4 commits
  • 3 files changed
  • 3 contributors

Commits on Jan 27, 2019

  1. go: 1.11.4 -> 1.11.5 

    https://groups.google.com/forum/#!msg/golang-announce/mVeX35iXuSw/Flp8FX7QEAAJ

We have just released Go 1.11.5 and Go 1.10.8 to address a recently reported security issue. We recommend that all users update to one of these releases (if you’re not sure which, choose Go 1.11.5).

This DoS vulnerability in the crypto/elliptic implementations of the P-521 and P-384 elliptic curves may let an attacker craft inputs that consume excessive amounts of CPU.

These inputs might be delivered via TLS handshakes, X.509 certificates, JWT tokens, ECDH shares or ECDSA signatures. In some cases, if an ECDH private key is reused more than once, the attack can also lead to key recovery.

The issue is CVE-2019-6486 and Go issue golang.org/issue/29903. See the Go issue for more details.
    @allowthere
    allowthere committed Jan 27, 2019
    Copy the full SHA
    d803da8 View commit details
    Browse the repository at this point in the history

  2. go_1_10: 1.10.7 -> 1.10.8 (security) 

    https://groups.google.com/forum/#!topic/golang-announce/mVeX35iXuSw
#54658
    @vcunat
    vcunat committed Jan 27, 2019
    Copy the full SHA
    d32e779 View commit details
    Browse the repository at this point in the history

  3. go_1_9: mark as insecure (see the parent commit) 

    Upstream only supports two latest releases.
golang/go#29903 (comment)
    @vcunat
    vcunat committed Jan 27, 2019
    Copy the full SHA
    a687ef9 View commit details
    Browse the repository at this point in the history

  4. Merge pull request #54658 from allowthere/patch-2 

    go: 1.11.4 -> 1.11.5
    @Mic92
    Mic92 committed Jan 27, 2019
    Copy the full SHA
    d5f340f View commit details
    Browse the repository at this point in the history