Commit afb57ff0 authored by Thomas Gerbet's avatar Thomas Gerbet
Browse files

elasticsearch: 7.17.10 -> 7.17.16 

Fixes CVE-2023-31417, CVE-2023-31418, CVE-2023-31419, CVE-2023-46673 and CVE-2023-46674.

Security announces:
https://www.elastic.co/guide/en/security/7.17/release-notes-header-7.17.0.html#release-notes-7.17.16

Release notes:
https://www.elastic.co/guide/en/elasticsearch/reference/7.17/release-notes-7.17.16.html
https://www.elastic.co/guide/en/elasticsearch/reference/7.17/release-notes-7.17.15.html
https://www.elastic.co/guide/en/elasticsearch/reference/7.17/release-notes-7.17.14.html
https://www.elastic.co/guide/en/elasticsearch/reference/7.17/release-notes-7.17.13.html
https://www.elastic.co/guide/en/elasticsearch/reference/7.17/release-notes-7.17.12.html
https://www.elastic.co/guide/en/elasticsearch/reference/7.17/release-notes-7.17.11.html
parent 85cbb44a

nixos/tests/elk.nix

+3 −3
Original line number Diff line number Diff line 
# To run the test on the unfree ELK use the following command:

# cd path/to/nixpkgs

# NIXPKGS_ALLOW_UNFREE=1 nix-build -A nixosTests.elk.unfree.ELK-6

# NIXPKGS_ALLOW_UNFREE=1 nix-build -A nixosTests.elk.unfree.ELK-7



{ system ? builtins.currentSystem,

  config ? {},
@@ -120,7 +120,7 @@ let 
              };



              elasticsearch-curator = {

                enable = true;

                enable = elk ? elasticsearch-curator;

                actionYAML = ''

                ---

                actions:
@@ -246,7 +246,7 @@ let 
          one.wait_until_succeeds(

              expect_hits("SuperdupercalifragilisticexpialidociousIndeed")

          )

    '' + ''

    '' + lib.optionalString (elk ? elasticsearch-curator) ''

      with subtest("Elasticsearch-curator works"):

          one.systemctl("stop logstash")

          one.systemctl("start elasticsearch-curator")

pkgs/misc/logging/beats/7.x.nix

+2 −2
Original line number Diff line number Diff line
@@ -8,10 +8,10 @@ let beat = package: extraArgs: buildGoModule (rec { 
    owner = "elastic";

    repo = "beats";

    rev = "v${version}";

    hash = "sha256-Quq32/3NeGhrsy17GrIeBiB3LGQuMFTFl3lAyyU6GZM=";

    hash = "sha256-0qwWHRIDLlnaPOCRmiiFGg+/jdanWuQtggM2QSaMR1o=";

  };



  vendorHash = "sha256-UJjwCRxY1rrymroBqC/SfCVM9vmnQOtLlS3OONih3kM=";

  vendorHash = "sha256-rwCCpptppkpvwQWUtqTjBUumP8GSpPHBTCaj0nYVQv8=";



  subPackages = [ package ];

pkgs/servers/search/elasticsearch/7.x.nix

+4 −4
Original line number Diff line number Diff line
@@ -18,10 +18,10 @@ let 
  plat = elemAt info 1;

  hashes =

    {

      x86_64-linux   = "sha512-eiAT5Dx/w56GoxpzPMdMWH7yu6DAE/lc6HT5i0iKT48Ob7JUoe7dXAsOIQrtmgGV9zWPqWU8iQ4jRBP/kxkIBw==";

      x86_64-darwin  = "sha512-5vSefA9Z4mCz49Q+Vzdck1KXbE9REYAF46kSf0G1n5XlHqFYzTGOmUEObZhGTqH4RDLJBdEqhLj2iyzjWQX5RA==";

      aarch64-linux  = "sha512-8nkPSbecOBJGu/h0MZGUUq+Tqk/YqmvJwfkDHn7V2cZJ9bq4Z8KKfRYC4ihdP0pfePgJrAV0SwKtZ9aGELtnfQ==";

      aarch64-darwin = "sha512-dbZrYGULuC3FF/SllPpAgW077Lkr87NJ8+gyTMayl8i8rOvAjnZhiR/U7eA6CZ/qVsFQkpGATdAzRXF8NlZBcg==";

      x86_64-linux   = "sha512-OiWGRxaCdRxXuxE/W04v87ytzOeUEcHRjF5nyRkdqSbZSnLXUyKOYQ4fKmk4til0VBOaKZYId20XyPiu/XTXNw==";

      x86_64-darwin  = "sha512-V/vKYL96+M1lp7ZJlvuneRBePWZmucUANfUrFPMuq+fnUP4nN69RStLWcgwgt65EspFMBwKVyQbak4swV8rWxw==";

      aarch64-linux  = "sha512-fNgVRaIIGx01reNHOnGKhMOG1aYU7gC8HLpIESSbM3+9xO1q9IHIaL/ObI/w2RYj/lD22d7PAdX5N6Hd1pVSAA==";

      aarch64-darwin = "sha512-DgexeyoxZ1YTPw9HjSUAM6eC8XtzIw7MY1WUVsIa8zl5j3RpCp25s3oI12BWefjYYCTjdtFDMsnoFSqZBabLig==";

    };

in

stdenv.mkDerivation rec {

pkgs/servers/search/elasticsearch/plugins.nix

+10 −10
Original line number Diff line number Diff line
@@ -38,7 +38,7 @@ in 
    src = fetchurl {

      url = "https://artifacts.elastic.co/downloads/elasticsearch-plugins/${pluginName}/${pluginName}-${version}.zip";

      hash =

        if version == "7.17.10" then "sha256-D08CVW/qHpZZaKnploM4aCJ4bunvPjVmieDYr1d6jQA="

        if version == "7.17.16" then "sha256-wgm6N5fofs5wTM25ZT3dJkg7iDesXsc3Up419IAY9gk="

        else throw "unsupported version ${version} for plugin ${pluginName}";

    };

    meta = with lib; {
@@ -54,7 +54,7 @@ in 
    src = fetchurl {

      url = "https://artifacts.elastic.co/downloads/elasticsearch-plugins/${pluginName}/${pluginName}-${version}.zip";

      hash =

        if version == "7.17.10" then "sha256-cpgr2zPCpsLrmshWJWoGNcGl0X+bO/K4A9bMqLv8+H8="

        if version == "7.17.16" then "sha256-SShdBcWfm21XoVhghSSiWIhsoXzG7wz6162iOmuf5EU="

        else throw "unsupported version ${version} for plugin ${pluginName}";

    };

    meta = with lib; {
@@ -87,7 +87,7 @@ in 
    src = fetchurl {

      url = "https://artifacts.elastic.co/downloads/elasticsearch-plugins/${pluginName}/${pluginName}-${version}.zip";

      hash =

        if version == "7.17.10" then "sha256-UmykO+hZDvlFhEbf7zL2bdw4j6NhByRBu9eH3F6/EtM="

        if version == "7.17.16" then "sha256-S/Cp9opeLitFh2/3Qw7/MFt6GcYKufxXKD6cJSi3SaQ="

        else throw "unsupported version ${version} for plugin ${pluginName}";

    };

    meta = with lib; {
@@ -103,7 +103,7 @@ in 
    src = fetchurl {

      url = "https://artifacts.elastic.co/downloads/elasticsearch-plugins/${pluginName}/${pluginName}-${version}.zip";

      hash =

        if version == "7.17.10" then "sha256-Y/AbLfHSdocX0NQbnKm63gTWgwzssb4kpSwRqLozD9w="

        if version == "7.17.16" then "sha256-hMErTLd5fXg420Olz+j6Zv7WByA1aNq9FlEgCtkYIxY="

        else throw "unsupported version ${version} for plugin ${pluginName}";

    };

    meta = with lib; {
@@ -119,7 +119,7 @@ in 
    src = fetchurl {

      url = "https://artifacts.elastic.co/downloads/elasticsearch-plugins/${pluginName}/${pluginName}-${version}.zip";

      hash =

        if version == "7.17.10" then "sha256-QIYD7cGpJQg+csv/tekN6GFtdnuhYU6VyAXk7nY/uWs="

        if version == "7.17.16" then "sha256-z0gfdx98urCzdQNlVn99CmteG6jweOmUDmGJW89twtU="

        else throw "unsupported version ${version} for plugin ${pluginName}";

    };

    meta = with lib; {
@@ -135,7 +135,7 @@ in 
    src = fetchurl {

      url = "https://artifacts.elastic.co/downloads/elasticsearch-plugins/${pluginName}/${pluginName}-${esVersion}.zip";

      hash =

        if version == "7.17.10" then "sha256-L8lS+EPYuhNNTnP3ImeZsBQ5a5DAncs3qBFDWGWISRI="

        if version == "7.17.16" then "sha256-TWMN8jzFjzBVTUB+zn4tJr47VMXHC8U+014BvnArK8M="

        else throw "unsupported version ${version} for plugin ${pluginName}";

    };

    meta = with lib; {
@@ -151,7 +151,7 @@ in 
    src = fetchurl {

      url = "https://artifacts.elastic.co/downloads/elasticsearch-plugins/${pluginName}/${pluginName}-${esVersion}.zip";

      hash =

        if version == "7.17.10" then "sha256-eXstbxlyS8WzW8u5YiMFXGpILCcEWrIb/IxXVzAGFLU="

        if version == "7.17.16" then "sha256-hG5wy1Xw4T1NzI7pja3CejwJg002/n6YqM1/QaVSWbg="

        else throw "unsupported version ${version} for plugin ${pluginName}";

    };

    meta = with lib; {
@@ -167,13 +167,13 @@ in 
    pluginName = "search-guard";

    version =

      # https://docs.search-guard.com/latest/search-guard-versions

      if esVersion == "7.17.10" then "${esVersion}-53.7.0"

      if esVersion == "7.17.16" then "${esVersion}-53.8.0"

      else throw "unsupported version ${esVersion} for plugin ${pluginName}";

    src =

      if esVersion == "7.17.10" then

      if esVersion == "7.17.16" then

        fetchurl {

          url = "https://maven.search-guard.com/search-guard-suite-release/com/floragunn/search-guard-suite-plugin/${version}/search-guard-suite-plugin-${version}.zip";

          hash = "sha256-FIF4O8z0U2giXVA2cNEdCDbpuJDJhaxHBOmv2fACucw=";

          hash = "sha256-j8dz7rUKWqMvT6EksoFIuGJzYcgdMipKeg2d8UtzlDI=";

        }

      else throw "unsupported version ${version} for plugin ${pluginName}";

    meta = with lib; {

pkgs/tools/misc/logstash/7.x.nix

+6 −6
Original line number Diff line number Diff line
@@ -16,14 +16,14 @@ let 
  hashes =

    if enableUnfree

    then {

      x86_64-linux  = "sha512-U5G/7wnEA6NlUYo6jo8HW7eXSxNwlbPH/SoBc8+m29SnRRFwo2V6/vPmpGjpCjjW56W2aXmYePk4n6RP+P7gJg==";

      x86_64-darwin = "sha512-jjUWuCMppHUFNY+36rSGyjlCOtxEofBhw19roiWsLzczDyr8PjfrZStlNuXKNdd6wkhd7HQ/qNmd1PzGC928IQ==";

      aarch64-linux = "sha512-BvkaWqv/D4akFQ3mwf0C+20KRLBKxmBZfLTINWzx0iVSqqd4mdtCpJpeNbPK1zvl17rYys+0sX5iKUkynN95Gg==";

      x86_64-linux  = "sha512-ze0hJxUHCN52bOxUs5upDj64tIE58P2BTow2kaCo6HreRiF9rfTTzNkNr/hCmEgE+/oFbgSEuOQLz+6G373RDQ==";

      x86_64-darwin = "sha512-FOFd8d+4UddSGorjuUWW/JbQ5fQH4LU1f1HJLmdbfnb8Q5L4GEveb2LmWNILU8/a85V4HGmD6lL8mCJqH9CULQ==";

      aarch64-linux = "sha512-giYqW88/6iT3haXzJVn/+b7uxjYhHq4GERmiq3tMIvjxDyu7B6g+X7JneaTYxhpNdn6gOD/hfXgNv+hFRq6lgg==";

    }

    else {

      x86_64-linux  = "sha512-uiLExBT0dRU4e7KMxHYSvqWK/5fEB/JXGGPoMXSivvJzYn9l3VMe2DPkBmjHkUSlAdScPsaRwbHE2PsMsSSwUg==";

      x86_64-darwin = "sha512-gal8oGwIb6wz8y6QEk9knV3c4J1kkCECD0NLdbW/9jBl+dyKome3LO3VgQibwk2xISL3Be+Laaz49Z8Rdxy/dw==";

      aarch64-linux = "sha512-ZK20GnobFLIdRjszPz9EcKTbkUDiiNN5v3lRDIMJHVyifpl5YddXzuIym4XRbabaihA4oArqux50q4+VuEGtCg==";

      x86_64-linux  = "sha512-OC9gx76k+RMdjqcDkrJCNbPYSQameyddaYMxUIB0foVxCmo6UvbdcwZGXRLPPn95in8rYOCjvPoBkmupiQw9xQ==";

      x86_64-darwin = "sha512-1OEfEED/jjlT3Fd095Y5VYiWKnovytI3UYCCy1Rs3tEvkZPHYwqIQHfMQYeAvGgUci37ADwEDu8xrSQULHToLw==";

      aarch64-linux = "sha512-QWW0AXOMNIXThxpUiRomvINm+917MvGrSDndrEw11IYYuvi0d0dckJiRytfnBbBNoOKpVhB68uOmfjIcZBNpWQ==";

    };

  this = stdenv.mkDerivation rec {

    version = elk7Version;