Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-2594

NIXPKGS-2026-2594

GitHub issue published 8 hours ago

PackageKit: dnf5 backend ignores SIMULATE on RepoRemove

Permalink CVE-2026-19816

7.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 8 hours ago by @erictapen Activity log

Created suggestion 14 hours ago
@LeSuisse ignored
19 packages
- gnome-packagekit
- fedora-backgrounds.f32
- fedora-backgrounds.f33
- fedora-backgrounds.f34
- fedora-backgrounds.f35
- fedora-backgrounds.f36
- fedora-backgrounds.f37
- fedora-backgrounds.f38
- kdePackages.packagekit-qt
- qt6Packages.packagekit-qt
- haskellPackages.fedora-krb
- haskellPackages.fedora-dists
- haskellPackages.fedora-releases
- python313Packages.python-fedora
- python314Packages.python-fedora
- python313Packages.fedora-messaging
- python314Packages.fedora-messaging
- haskellPackages.fedora-haskell-tools
- gnomeExtensions.fedora-linux-update-indicator
10 hours ago
@erictapen accepted 8 hours ago
@erictapen published on GitHub 8 hours ago

PackageKit: dnf5 backend ignores SIMULATE on RepoRemove

A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as (role == REPO_REMOVE || !SIMULATE), which is always true for RepoRemove. An unprivileged local user can therefore perform a genuine package uninstall while claiming to simulate. This vulnerability only affects systems using PackageKit with the dnf5 backend.

References

https://github.com/PackageKit/PackageKit/commit/33be77b3ecd3b566ca117358dc18c58… patch
https://github.com/PackageKit/PackageKit/security/advisories/GHSA-g5gf-h68q-gxc8 vendor-advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2515940 issue-tracking

Affected products

PackageKit

<1.4.0

compat-PackageKit08

Matching in nixpkgs

pkgs.packagekit

System to facilitate installing and updating packages

nixos-unstable 1.3.5
- nixpkgs-unstable 1.3.5
- nixos-unstable-small 1.3.5
nixos-26.05 1.3.5
- nixos-26.05-small 1.3.5
- nixpkgs-26.05-darwin 1.3.5

Ignored packages (19)

pkgs.gnome-packagekit

Tools for installing software on the GNOME desktop using PackageKit

nixos-unstable 43.0
- nixpkgs-unstable 43.0
- nixos-unstable-small 43.0
nixos-26.05 43.0
- nixos-26.05-small 43.0
- nixpkgs-26.05-darwin 43.0

pkgs.fedora-backgrounds.f32

Set of default and supplemental wallpapers for Fedora

nixos-unstable 32.2.2
- nixpkgs-unstable 32.2.2
- nixos-unstable-small 32.2.2
nixos-26.05 32.2.2
- nixos-26.05-small 32.2.2
- nixpkgs-26.05-darwin 32.2.2

pkgs.fedora-backgrounds.f33

Set of default and supplemental wallpapers for Fedora

nixos-unstable 33.0.7
- nixpkgs-unstable 33.0.7
- nixos-unstable-small 33.0.7
nixos-26.05 33.0.7
- nixos-26.05-small 33.0.7
- nixpkgs-26.05-darwin 33.0.7

pkgs.fedora-backgrounds.f34

Set of default and supplemental wallpapers for Fedora

nixos-unstable 34.0.1
- nixpkgs-unstable 34.0.1
- nixos-unstable-small 34.0.1
nixos-26.05 34.0.1
- nixos-26.05-small 34.0.1
- nixpkgs-26.05-darwin 34.0.1

pkgs.fedora-backgrounds.f35

Set of default and supplemental wallpapers for Fedora

nixos-unstable 35.0.1
- nixpkgs-unstable 35.0.1
- nixos-unstable-small 35.0.1
nixos-26.05 35.0.1
- nixos-26.05-small 35.0.1
- nixpkgs-26.05-darwin 35.0.1

pkgs.fedora-backgrounds.f36

Set of default and supplemental wallpapers for Fedora

nixos-unstable 36.1.2
- nixpkgs-unstable 36.1.2
- nixos-unstable-small 36.1.2
nixos-26.05 36.1.2
- nixos-26.05-small 36.1.2
- nixpkgs-26.05-darwin 36.1.2

pkgs.fedora-backgrounds.f37

Set of default and supplemental wallpapers for Fedora

nixos-unstable 37.0.5
- nixpkgs-unstable 37.0.5
- nixos-unstable-small 37.0.5
nixos-26.05 37.0.5
- nixos-26.05-small 37.0.5
- nixpkgs-26.05-darwin 37.0.5

pkgs.fedora-backgrounds.f38

Set of default and supplemental wallpapers for Fedora

nixos-unstable 38.1.1
- nixpkgs-unstable 38.1.1
- nixos-unstable-small 38.1.1
nixos-26.05 38.1.1
- nixos-26.05-small 38.1.1
- nixpkgs-26.05-darwin 38.1.1

pkgs.kdePackages.packagekit-qt

System to facilitate installing and updating packages - Qt

nixos-unstable 1.1.4
- nixpkgs-unstable 1.1.4
- nixos-unstable-small 1.1.4
nixos-26.05 1.1.4
- nixos-26.05-small 1.1.4
- nixpkgs-26.05-darwin 1.1.4

pkgs.qt6Packages.packagekit-qt

System to facilitate installing and updating packages - Qt

nixos-unstable 1.1.4
- nixpkgs-unstable 1.1.4
- nixos-unstable-small 1.1.4
nixos-26.05 1.1.4
- nixos-26.05-small 1.1.4
- nixpkgs-26.05-darwin 1.1.4

pkgs.haskellPackages.fedora-krb

Kerberos for Fedora packagers

nixos-unstable 0.1.0
- nixpkgs-unstable 0.1.0
- nixos-unstable-small 0.1.0
nixos-26.05 0.1.0
- nixos-26.05-small 0.1.0
- nixpkgs-26.05-darwin 0.1.0

pkgs.haskellPackages.fedora-dists

Library for Fedora distribution versions

nixos-unstable 2.1.1
- nixpkgs-unstable 2.1.1
- nixos-unstable-small 2.1.1
nixos-26.05 2.1.1
- nixos-26.05-small 2.1.1
- nixpkgs-26.05-darwin 2.1.1

pkgs.haskellPackages.fedora-releases

Library for Fedora release versions

nixos-unstable 0.3.0
- nixpkgs-unstable 0.3.0
- nixos-unstable-small 0.3.0
nixos-26.05 0.3.0
- nixos-26.05-small 0.3.0
- nixpkgs-26.05-darwin 0.3.0

pkgs.python313Packages.python-fedora

Module to interact with the infrastructure of the Fedora Project

nixos-unstable 1.1.1
- nixpkgs-unstable 1.1.1
- nixos-unstable-small 1.1.1
nixos-26.05 1.1.1
- nixos-26.05-small 1.1.1
- nixpkgs-26.05-darwin 1.1.1

pkgs.python314Packages.python-fedora

Module to interact with the infrastructure of the Fedora Project

nixos-unstable 1.1.1
- nixpkgs-unstable 1.1.1
- nixos-unstable-small 1.1.1
nixos-26.05 1.1.1
- nixos-26.05-small 1.1.1
- nixpkgs-26.05-darwin 1.1.1

pkgs.python313Packages.fedora-messaging

Library for sending AMQP messages with JSON schema in Fedora infrastructure

nixos-unstable 3.9.1
- nixpkgs-unstable 3.9.1
- nixos-unstable-small 3.9.1
nixos-26.05 3.9.0
- nixos-26.05-small 3.9.0
- nixpkgs-26.05-darwin 3.9.0

pkgs.python314Packages.fedora-messaging

Library for sending AMQP messages with JSON schema in Fedora infrastructure

nixos-unstable 3.9.1
- nixpkgs-unstable 3.9.1
- nixos-unstable-small 3.9.1
nixos-26.05 3.9.0
- nixos-26.05-small 3.9.0
- nixpkgs-26.05-darwin 3.9.0

pkgs.haskellPackages.fedora-haskell-tools

Building and maintenance tools for Fedora Haskell

nixos-unstable 1.2
- nixpkgs-unstable 1.2
- nixos-unstable-small 1.2
nixos-26.05 1.2
- nixos-26.05-small 1.2
- nixpkgs-26.05-darwin 1.2

pkgs.gnomeExtensions.fedora-linux-update-indicator

GNOME Shell update indicator for Fedora Linux.

nixos-unstable 41
- nixpkgs-unstable 41
- nixos-unstable-small 45
nixos-26.05 41
- nixos-26.05-small 41
- nixpkgs-26.05-darwin 41