Nixpkgs security tracker
5.5 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): None (N)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): None (N)
by @LeSuisse Activity log
- Created suggestion
- @LeSuisse accepted
- @LeSuisse published on GitHub
Nextflow: Incorrect default permissions in the nextflow auth login command
Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to ${NXF_HOME:-~/.nextflow}/seqera-auth.config through AuthCommandImpl.writeConfig in plugins/nf-tower/src/main/io/seqera/tower/plugin/auth/AuthCommandImpl.groovy without setting restrictive file permissions, allowing the default umask 022 to create the file with mode 0644. On a multi-user POSIX host, a local user who can traverse the victim's home directory can read seqera-auth.config and impersonate the victim against Seqera Platform within the token's scope. Single-user systems and headless CI runners that do not use the interactive login flow are not affected. This issue is fixed in 25.10.6 and 26.04.3.
References
-
https://github.com/nextflow-io/nextflow/security/advisories/GHSA-92qf-fcph-v5wr x_refsource_CONFIRM
-
https://github.com/nextflow-io/nextflow/pull/7182 x_refsource_MISC
-
https://github.com/nextflow-io/nextflow/releases/tag/v25.10.6 x_refsource_MISC
-
https://github.com/nextflow-io/nextflow/releases/tag/v26.04.3 x_refsource_MISC
Affected products
- ==>= 25.09.2-edge, < 25.10.6
- ==>= 25.11.0-edge, < 26.04.3
Package maintainers
-
@Etjean Etienne Jean <et.jean@outlook.fr>
-
@David-Moody David Moody <david.moody@scot.me.uk>
-
@mulatta Seungwon Lee <seungwon@mulatta.io>