Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-1022

NIXPKGS-2026-1022

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-34720

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
3 packages
- python312Packages.zammad-py
- python313Packages.zammad-py
- python314Packages.zammad-py
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

Zammad has an origin validation error in SSO mechanism

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the SSO mechanism in Zammad was not verifying the header originates from a trusted SSO proxy/gateway before applying further actions on it. This vulnerability is fixed in 7.0.1 and 6.5.4.

References

https://github.com/zammad/zammad/security/advisories/GHSA-hcv6-w4h9-p2p7 x_refsource_CONFIRM

Affected products

zammad

==>= 7.0.0-alpha, < 7.0.1
==< 6.5.4

Matching in nixpkgs

pkgs.zammad

Web-based, open source user support/ticketing solution

nixos-unstable 7.0.0
- nixpkgs-unstable 7.0.0
- nixos-unstable-small 7.0.0

Ignored packages (3)

pkgs.python312Packages.zammad-py

None

pkgs.python313Packages.zammad-py

Python API client for accessing zammad REST API

nixos-unstable 3.2.1
- nixpkgs-unstable 3.2.1
- nixos-unstable-small 3.2.1

pkgs.python314Packages.zammad-py

Python API client for accessing zammad REST API

nixos-unstable 3.2.1
- nixpkgs-unstable 3.2.1
- nixos-unstable-small 3.2.1

Package maintainers

@meenzen Samuel Meenzen <samuel@meenzen.net>
@Radvendii Taeer Bar-Yam <taeer@necsi.edu>
@NetaliDev Jennifer Graul <me@netali.de>