From d8173f21f7b4e3cb83541b8fa70621d2b6d4ce1c Mon Sep 17 00:00:00 2001 From: Leo Famulari Date: Wed, 2 Mar 2016 22:45:36 -0500 Subject: gnu: perl: Replace with patched version [fixes CVE-2016-2381]. * gnu/packages/patches/perl-CVE-2016-2381.patch: New file. * gnu-system.am (dist_patch_DATA): Add it. * gnu/packages/perl.scm (perl)[replacement]: New field. (perl-fixed): New variable. * gnu/packages/commencement.scm (perl-boot0)[replacement]: New field. --- gnu/packages/perl.scm | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) (limited to 'gnu/packages/perl.scm') diff --git a/gnu/packages/perl.scm b/gnu/packages/perl.scm index 6ca62aa2ae..d67870f462 100644 --- a/gnu/packages/perl.scm +++ b/gnu/packages/perl.scm @@ -37,6 +37,7 @@ (define-public perl ;; Yeah, Perl... It is required early in the bootstrap process by Linux. (package + (replacement perl-fixed) (name "perl") (version "5.22.1") (source (origin @@ -114,6 +115,28 @@ (home-page "http://www.perl.org/") (license gpl1+))) ; or "Artistic" +(define perl-fixed + (package + (inherit perl) + (replacement #f) + (source + (let ((name "perl") (version "5.22.1")) + (origin + (method url-fetch) + (uri (string-append "http://www.cpan.org/src/5.0/perl-" + version ".tar.gz")) + (sha256 + (base32 + "09wg24w5syyafyv87l6z8pxwz4bjgcdj996bx5844k6m9445sirb")) + (patches (map search-patch + '("perl-no-sys-dirs.patch" + "perl-autosplit-default-time.patch" + "perl-source-date-epoch.patch" + "perl-deterministic-ordering.patch" + "perl-no-build-time.patch" + "perl-CVE-2015-8607.patch" + "perl-CVE-2016-2381.patch")))))))) + (define-public perl-algorithm-c3 (package (name "perl-algorithm-c3") -- cgit v1.2.3