botan2: 2.18.0 -> 2.18.1, add patch for CVE-2021-40529

[risicle]

Motivation for this change

https://nvd.nist.gov/vuln/detail/CVE-2021-40529

No release including this fix yet. Bumped at the same time to ensure patch was as applicable as possible.

Also marked botan as vulnerable to this.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• 21.11 Release Notes (or backporting 21.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

[r-rmcgibbo]

Result of nixpkgs-review pr 137041 at 785fa83 run on aarch64-linux 1

1 package failed to build:

• neopg

1 package skipped due to time constraints:

• kea

6 packages built successfully:

• biboumi
• botan2
• corectrl
• monotone
• rnp
• softhsm

Note that build failures may predate this PR, and could be nondeterministic or hardware dependent.
Please exercise your independent judgement. Does something look off? Please file an issue or reach out on IRC.

---

Result of nixpkgs-review pr 137041 at 785fa83 run on x86_64-linux 1

2 packages failed to build:

• neopg
• tlspool

1 package skipped due to time constraints:

• kea

6 packages built successfully:

• biboumi
• botan2
• corectrl
• monotone
• rnp
• softhsm

1 suggestion:

• warning: missing-phase-hooks

  configurePhase should probably contain runHook preConfigure and runHook postConfigure.

  Near pkgs/development/libraries/botan/generic.nix:32:3:

     |
  32 |   configurePhase = ''
     |   ^
  

Note that build failures may predate this PR, and could be nondeterministic or hardware dependent.
Please exercise your independent judgement. Does something look off? Please file an issue or reach out on IRC.

[github-actions]

Successfully created backport PR #137065 for release-21.05.