Release 2024_021 (2024-07-15)¶

Impact¶

• [NixOS 23.11] sshd.service will be restarted.
• [NixOS 23.05] sshd.service will be restarted.
• [NixOS 22.11] sshd.service will be restarted.
• [NixOS 22.05] sshd.service will be restarted.

NixOS 24.05 platform¶

This is the first production release of the 24.05 platform. The default for new VMs is still 23.11 which will be changed in the coming weeks.

See Platform Upgrades & What's New for things to consider before upgrading, significant changes and new package versions

• Production channel URL for this release: https://hydra.flyingcircus.io/build/457353/download/1/nixexprs.tar.xz

NixOS 23.11 platform¶

• openssh: apply patches for CVE-2024-6387
• already released as a hotfix ahead of schedule on 2024-07-01
• fixes a remote code execution vulnerability https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
• additionally also backport a fix for a minor logic error in ObscureKeystrokeTiming
• Production channel URL for this release: https://hydra.flyingcircus.io/build/450243/download/1/nixexprs.tar.xz

NixOS 23.05 platform¶

• openssh: apply patches for CVE-2024-6387
• already released as a hotfix ahead of schedule on 2024-07-01
• fixes a remote code execution vulnerability https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
• additionally also backport a fix for a minor logic error in ObscureKeystrokeTiming
• Production channel URL for this release: https://hydra.flyingcircus.io/build/456547/download/1/nixexprs.tar.xz

NixOS 22.11 platform¶

• Fix statically configured time server (NTP) names.
• Production channel URL for this release: https://hydra.flyingcircus.io/build/458782/download/1/nixexprs.tar.xz

NixOS 22.05 platform¶

• Fix statically configured time server (NTP) names.
• openssh: apply patches for https://github.com/advisories/GHSA-2x8c-95vh-gfv4, default package used changes 9.0p1 -> 9.6p1. This was already released as a hotfix on 2024-07-05. Also fixes a remote code execution vulnerability https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt. Note that this only updates the openssh_9_6 package, which is used by the in-path ssh command and the sshd.service of the platform. This might affect the defaults for cryptographic algorithms, see the openssh release notes for details.
• Production channel URL for this release: https://hydra.flyingcircus.io/build/457389/download/1/nixexprs.tar.xz

Detailed Changes¶

• NixOS 23.11: platform code
• NixOS 23.05: platform code
• NixOS 22.11: platform code
• NixOS 22.05: platform code

% vim: set spell spelllang=en: