Nixpkgs security tracker
5.3 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): Low (L)
- Integrity (I): None (N)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): None (N)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
3 packages
- rekor-cli
- python312Packages.sigstore-rekor-types
- python313Packages.sigstore-rekor-types
-
@LeSuisse
deleted
maintainer.delete
2 maintainers
- @developer-guy
- @06kellyjac
-
@LeSuisse
added
maintainer.add
2 maintainers
- @fabaff
- @Bot-wxt1221
-
@LeSuisse
deleted
maintainer.delete
3 maintainers
- @LeSuisse
- @Bot-wxt1221
- @fabaff
- @LeSuisse added maintainer @LeSuisse maintainer.add
- @LeSuisse accepted
- @LeSuisse published on GitHub
Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL
Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index/retrieve supports retrieving a public key via user-provided URL. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. The issue has been fixed in version 1.5.0. To workaround this issue, disable the search endpoint with --enable_retrieve_api=false.
References
-
https://github.com/sigstore/rekor/security/advisories/GHSA-4c4x-jm2x-pf9j x_refsource_CONFIRM
-
https://github.com/sigstore/rekor/releases/tag/v1.5.0 x_refsource_MISC
Affected products
- ==< 1.5.0
Matching in nixpkgs
pkgs.rekor-server
Sigstore server, the Signature Transparency Log
Ignored packages (3)
pkgs.rekor-cli
CLI client for Sigstore, the Signature Transparency Log
pkgs.python312Packages.sigstore-rekor-types
Python models for Rekor's API types
pkgs.python313Packages.sigstore-rekor-types
Python models for Rekor's API types
Package maintainers
-
@LeSuisse Thomas Gerbet <thomas@gerbet.me>
Ignored maintainers (2)
-
@developer-guy Batuhan Apaydın <developerguyn@gmail.com>
-
@06kellyjac Jack <hello+nixpkgs@j-k.io>