From eaafd840bf45c239143701a0e6bff0e294d84350 Mon Sep 17 00:00:00 2001 From: adisbladis Date: Thu, 25 Jul 2019 22:05:13 +0100 Subject: [PATCH] Revert "unzip: CVE-2019-13232" This reverts commit 0238946872c1c63709790f6285bf9cc5585a6704. This patch broke a number of legitimate zips in the wild, including but not limited to most luarocks and a number of gradle-produced JARs. --- pkgs/tools/archivers/unzip/default.nix | 5 ----- 1 file changed, 5 deletions(-) diff --git a/pkgs/tools/archivers/unzip/default.nix b/pkgs/tools/archivers/unzip/default.nix index 749f481d8903..cdf189e82df5 100644 --- a/pkgs/tools/archivers/unzip/default.nix +++ b/pkgs/tools/archivers/unzip/default.nix @@ -26,11 +26,6 @@ stdenv.mkDerivation { ./CVE-2016-9844.patch ./CVE-2018-18384.patch ./dont-hardcode-cc.patch - (fetchurl { - url = "https://github.com/madler/unzip/commit/47b3ceae397d21bf822bc2ac73052a4b1daf8e1c.patch"; - name = "CVE-2019-13232.patch"; - sha256 = "0iy2wcjyvzwrjk02iszwcpg85fkjxs1bvb9isvdiywszav4yjs32"; - }) ] ++ stdenv.lib.optional enableNLS (fetchurl { url = "http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/app-arch/unzip/files/unzip-6.0-natspec.patch?revision=1.1";