From 1c32eb95af304800b65c0bdebe0ea81f70b90080 Mon Sep 17 00:00:00 2001
From: Efraim Flashner <efraim@flashner.co.il>
Date: Thu, 11 Jun 2020 11:46:51 +0300
Subject: gnu: serf: Use a mirror URL.

* gnu/packages/web.scm (serf)[source]: Use an apache mirror:// URL.
---
 gnu/packages/web.scm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'gnu/packages/web.scm')

diff --git a/gnu/packages/web.scm b/gnu/packages/web.scm
index 30ef341fa3..82174c0033 100644
--- a/gnu/packages/web.scm
+++ b/gnu/packages/web.scm
@@ -1575,7 +1575,7 @@ (define-public serf
     (source
      (origin
        (method url-fetch)
-       (uri (string-append "https://archive.apache.org/dist/serf/serf-"
+       (uri (string-append "mirror://apache/dist/serf/serf-"
                            version ".tar.bz2"))
        (sha256
         (base32 "1k47gbgpp52049andr28y28nbwh9m36bbb0g8p0aka3pqlhjv72l"))))
-- 
cgit v1.2.3


From ecf92194a55188a9c217d76617378749db063453 Mon Sep 17 00:00:00 2001
From: Ludovic Courtès <ludo@gnu.org>
Date: Thu, 11 Jun 2020 18:54:15 +0200
Subject: gnu: nghttp2: Replace with version 1.41 [fixes CVE-2020-11080].

* gnu/packages/web.scm (nghttp2-1.41): New variable.
(nghttp2)[replacement]: New field.
---
 gnu/packages/web.scm | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

(limited to 'gnu/packages/web.scm')

diff --git a/gnu/packages/web.scm b/gnu/packages/web.scm
index 82174c0033..a04d755a83 100644
--- a/gnu/packages/web.scm
+++ b/gnu/packages/web.scm
@@ -7193,6 +7193,7 @@ (define-public nghttp2
   (package
     (name "nghttp2")
     (version "1.40.0")
+    (replacement nghttp2-1.41)
     (source
      (origin
        (method url-fetch)
@@ -7272,6 +7273,20 @@ (define-public nghttp2
 @end itemize\n")
     (license license:expat)))
 
+(define-public nghttp2-1.41                       ;fixes CVE-2020-11080
+  (package
+    (inherit nghttp2)
+    (version "1.41.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/nghttp2/nghttp2/"
+                           "releases/download/v" version "/"
+                           "nghttp2-" version ".tar.xz"))
+       (sha256
+        (base32
+         "1hk77vngjmvvzb5y1gi1aqwf6qywrc7yak08zvzb7x81qs6mphmb"))))))
+
 (define-public hpcguix-web
   (let ((commit "9de63562b06b4aef3a3afe5ecb18d3c91e57ee74")
         (revision "5"))
-- 
cgit v1.2.3