diff --git a/pkgs/development/libraries/libtasn1/default.nix b/pkgs/development/libraries/libtasn1/default.nix
index 3b74406d7bf..dbd203b97cf 100644
--- a/pkgs/development/libraries/libtasn1/default.nix
+++ b/pkgs/development/libraries/libtasn1/default.nix
@@ -8,6 +8,14 @@ stdenv.mkDerivation rec {
     sha256 = "00jsix5hny0g768zv4hk78dib7w0qmk5fbizf4jj37r51nd4s6k8";
   };
 
+  patches = [
+    (fetchurl {
+      name = "CVE-2017-6891.patch";
+      url = "https://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=patch;h=5520704d075802df25ce4ffccc010ba1641bd484";
+      sha256 = "000r6wb87zkx8yhzkf1c3h7p5akwhjw51cv8f1yjnplrqqrr7h2k";
+    })
+  ];
+
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "dev";