NIXPKGS-2025-0015

GitHub issue published 9 months ago

Permalink CVE-2025-8396

updated 9 months ago by @LeSuisse Activity log

• Created suggestion 11 months, 4 weeks ago
• @LeSuisse ignored
  14 packages

  • temporal-cli
  • python312Packages.temporalio
  • python313Packages.temporalio
  • haskellPackages.temporal-media
  • terraform-providers.temporalcloud
  • postgresqlPackages.temporal_tables
  • postgresql13Packages.temporal_tables
  • postgresql14Packages.temporal_tables
  • postgresql15Packages.temporal_tables
  • postgresql16Packages.temporal_tables
  • postgresql18Packages.temporal_tables
  • haskellPackages.temporal-music-notation
  • haskellPackages.temporal-music-notation-demo
  • haskellPackages.temporal-music-notation-western
  10 months, 2 weeks ago
• @LeSuisse accepted 10 months, 2 weeks ago
• @LeSuisse published on GitHub 9 months ago

Insufficiently specific bounds checking on authorization header could lead to …

• https://github.com/temporalio/temporal/releases/tag/v1.26.3
• https://github.com/temporalio/temporal/releases/tag/v1.27.3
• https://github.com/temporalio/temporal/releases/tag/v1.28.1

---

temporal

• <1.28.1
• <1.26.3
• <1.27.3

NIXPKGS-2025-0022

published 9 months ago

Permalink CVE-2025-11060

5.7 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 9 months ago by @LeSuisse Activity log

• Created suggestion 9 months, 3 weeks ago
• @LeSuisse ignored package surrealdb-migrations 9 months ago
• @LeSuisse accepted 9 months ago
• @LeSuisse published on GitHub 9 months ago

Surrealdb: surrealdb is vulnerable to unauthorized data exposure via live query subscriptions

• https://access.redhat.com/security/cve/CVE-2025-11060 x_refsource_REDHATvdb-entry
• RHBZ#2394708 x_refsource_REDHATissue-tracking
• https://github.com/surrealdb/surrealdb
• https://github.com/surrealdb/surrealdb/commit/d81169a06b89f0c588134ddf2d62eeb8d…
• https://github.com/surrealdb/surrealdb/pull/6247
• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-7vm2-j586-vcvc
• https://surrealdb.com/docs/surrealql/statements/live

---

surrealdb

• <2.3.8
• <3.3.0-alpha.7
• <2.1.9
• <2.2.8

openshift-service-mesh/istio-cni-rhel9

openshift-service-mesh/istio-pilot-rhel9

openshift-service-mesh/istio-proxyv2-rhel9

openshift-service-mesh/istio-rhel9-operator

openshift-service-mesh/istio-must-gather-rhel9

openshift-service-mesh/istio-sail-operator-bundle

openshift-service-mesh-tech-preview/istio-ztunnel-rhel9

openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9

NIXPKGS-2025-0020

published 9 months ago

Permalink CVE-2025-54770

4.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 9 months ago by @LeSuisse Activity log

• Created suggestion 9 months, 3 weeks ago
• @LeSuisse ignored
  2 packages

  • grub2_pvgrub_image
  • grub2_pvhgrub_image
  9 months ago
• @LeSuisse deleted maintainer @SigmaSquadron 9 months ago maintainer.delete
• @LeSuisse added
  2 maintainers

  • @hehongbo
  • @digitalrane
  9 months ago maintainer.add
• @LeSuisse deleted maintainer @hehongbo 9 months ago maintainer.delete
• @LeSuisse added maintainer @CertainLach 9 months ago maintainer.add
• @LeSuisse deleted
  2 maintainers

  • @digitalrane
  • @CertainLach
  9 months ago maintainer.delete
• @LeSuisse accepted 9 months ago
• @LeSuisse published on GitHub 9 months ago

Grub2: use-after-free in net_set_vlan

• https://access.redhat.com/security/cve/CVE-2025-54770 x_refsource_REDHATvdb-entry
• RHBZ#2413813 x_refsource_REDHATissue-tracking
• http://www.openwall.com/lists/oss-security/2025/11/18/4

---

grub2

• =<2.14

rhcos

NIXPKGS-2025-0019

published 9 months ago

Permalink CVE-2025-54771

4.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 9 months ago by @LeSuisse Activity log

• Created suggestion 9 months, 3 weeks ago
• @LeSuisse ignored
  2 packages

  • grub2_pvgrub_image
  • grub2_pvhgrub_image
  9 months ago
• @LeSuisse deleted maintainer @SigmaSquadron 9 months ago maintainer.delete
• @LeSuisse added
  2 maintainers

  • @hehongbo
  • @digitalrane
  9 months ago maintainer.add
• @LeSuisse deleted
  2 maintainers

  • @hehongbo
  • @digitalrane
  9 months ago maintainer.delete
• @LeSuisse accepted 9 months ago
• @LeSuisse published on GitHub 9 months ago

Grub2: use-after-free in grub_file_close()

• https://access.redhat.com/security/cve/CVE-2025-54771 x_refsource_REDHATvdb-entry
• RHBZ#2413823 x_refsource_REDHATissue-tracking
• http://www.openwall.com/lists/oss-security/2025/11/18/3

---

grub2

• =<2.14

rhcos

NIXPKGS-2025-0018

published 9 months ago

Permalink CVE-2025-61662

4.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 9 months ago by @LeSuisse Activity log

• Created suggestion 9 months, 3 weeks ago
• @LeSuisse deleted
  4 maintainers

  • @SigmaSquadron
  • @hehongbo
  • @digitalrane
  • @CertainLach
  9 months ago maintainer.delete
• @LeSuisse ignored
  2 packages

  • grub2_pvhgrub_image
  • grub2_pvgrub_image
  9 months ago
• @LeSuisse accepted 9 months ago
• @LeSuisse published on GitHub 9 months ago

Grub2: missing unregister call for gettext command may lead to use-after-free

• https://access.redhat.com/security/cve/CVE-2025-61662 x_refsource_REDHATvdb-entry
• RHBZ#2414683 x_refsource_REDHATissue-tracking
• http://www.openwall.com/lists/oss-security/2025/11/18/5

---

grub2

• =<2.14

rhcos

NIXPKGS-2025-0017

GitHub issue published 9 months ago

Permalink CVE-2025-61663

4.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 9 months ago by @LeSuisse Activity log

• Created suggestion 9 months, 3 weeks ago
• @LeSuisse deleted
  4 maintainers

  • @SigmaSquadron
  • @hehongbo
  • @digitalrane
  • @CertainLach
  9 months ago maintainer.delete
• @LeSuisse ignored
  2 packages

  • grub2_pvgrub_image
  • grub2_pvhgrub_image
  9 months ago
• @LeSuisse accepted 9 months ago
• @LeSuisse published on GitHub 9 months ago

Grub2: missing unregister call for normal commands may lead to use-after-free

• https://access.redhat.com/security/cve/CVE-2025-61663 x_refsource_REDHATvdb-entry
• RHBZ#2414684 x_refsource_REDHATissue-tracking

---

grub2

• =<2.14

rhcos

NIXPKGS-2025-0021

GitHub issue published 9 months ago

Permalink CVE-2025-61664

4.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 9 months ago by @LeSuisse Activity log

• Created suggestion 9 months, 3 weeks ago
• @LeSuisse ignored
  2 packages

  • grub2_pvgrub_image
  • grub2_pvhgrub_image
  9 months ago
• @LeSuisse deleted maintainer @SigmaSquadron 9 months ago maintainer.delete
• @LeSuisse added
  3 maintainers

  • @hehongbo
  • @digitalrane
  • @CertainLach
  9 months ago maintainer.add
• @LeSuisse deleted
  3 maintainers

  • @hehongbo
  • @digitalrane
  • @CertainLach
  9 months ago maintainer.delete
• @LeSuisse accepted 9 months ago
• @LeSuisse published on GitHub 9 months ago

Grub2: missing unregister call for normal_exit command may lead to use-after-free

• https://access.redhat.com/security/cve/CVE-2025-61664 x_refsource_REDHATvdb-entry
• RHBZ#2414685 x_refsource_REDHATissue-tracking

---

grub2

• =<2.14

rhcos

NIXPKGS-2025-0014

GitHub issue published 9 months ago

Permalink CVE-2025-13502

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 9 months ago by @LeSuisse Activity log

• Created suggestion 9 months, 3 weeks ago
• @LeSuisse ignored
  5 packages

  • tests.pkg-config.defaultPkgConfigPackages."webkit2gtk-4.0"
  • obs-studio-plugins.obs-webkitgtk
  • haskellPackages.webkit2gtk3-javascriptcore
  • tests.pkg-config.defaultPkgConfigPackages."javascriptcoregtk-4.0"
  • tests.pkg-config.defaultPkgConfigPackages."webkit2gtk-web-extension-4.0"
  9 months ago
• @LeSuisse deleted
  4 maintainers

  • @jtojnar
  • @bobby285271
  • @hedning
  • @dasj19
  9 months ago maintainer.delete
• @LeSuisse accepted 9 months ago
• @LeSuisse published on GitHub 9 months ago

Webkit: webkitgtk / wpe webkit: out-of-bounds read and integer underflow vulnerability leading to dos

• https://access.redhat.com/security/cve/CVE-2025-13502 x_refsource_REDHATvdb-entry
• RHBZ#2416300 x_refsource_REDHATissue-tracking
• RHSA-2025:22789 x_refsource_REDHATvendor-advisory
• RHSA-2025:22790 x_refsource_REDHATvendor-advisory
• RHSA-2025:23110 x_refsource_REDHATvendor-advisory
• RHSA-2025:23433 x_refsource_REDHATvendor-advisory
• RHSA-2025:23434 x_refsource_REDHATvendor-advisory
• RHSA-2025:23451 x_refsource_REDHATvendor-advisory
• RHSA-2025:23452 x_refsource_REDHATvendor-advisory
• RHSA-2025:23583 x_refsource_REDHATvendor-advisory
• RHSA-2025:23591 x_refsource_REDHATvendor-advisory
• RHSA-2025:23742 x_refsource_REDHATvendor-advisory
• RHSA-2025:23743 x_refsource_REDHATvendor-advisory

---

webkitgtk

• <2.50.2

webkitgtk3

webkitgtk4

• *

webkit2gtk3

• *

NIXPKGS-2025-0013

published 9 months ago

Permalink CVE-2025-10230

10.0 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 9 months ago by @mweinelt Activity log

• Created suggestion 9 months, 3 weeks ago
• @mweinelt ignored package sambamba 9 months ago
• @mweinelt accepted 9 months ago
• @mweinelt published on GitHub 9 months ago

Samba: command injection in wins server hook script

• https://access.redhat.com/security/cve/CVE-2025-10230 x_refsource_REDHATvdb-entry
• RHBZ#2394377 x_refsource_REDHATissue-tracking
• https://www.samba.org/samba/history/security.html
• https://www.vicarius.io/vsociety/posts/cve-2025-10230-detect-samba-vulnerability
• https://www.vicarius.io/vsociety/posts/cve-2025-10230-mitigate-samba-vulnerabil…

---

rhcos

samba

• <4.21.5
• <4.23.2
• <4.21.9

samba4

Fixed in:
https://github.com/NixOS/nixpkgs/pull/433796
https://github.com/NixOS/nixpkgs/pull/452396

NIXPKGS-2025-0012

published 9 months ago

Permalink CVE-2025-11935

updated 9 months ago by @LeSuisse Activity log

• Created suggestion 9 months, 3 weeks ago
• @LeSuisse accepted 9 months ago
• @LeSuisse published on GitHub 9 months ago

Forward Secrecy Violation in WolfSSL TLS 1.3

• https://github.com/wolfSSL/wolfssl
• https://github.com/wolfSSL/wolfssl/pull/9112

---

wolfssl

• <5.8.4
• ==v5.8.2