Nixpkgs Security Tracker

Login with GitHub

Automatically generated suggestions

to queue a suggestion for refinement.

to remove a suggestion from the queue.

CVE-2024-52338
9.8 CRITICAL
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 3 months ago
Apache Arrow R package: Arbitrary code execution when loading a malicious data file

Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example, user-supplied input files). This vulnerability only affects the arrow R package, not other Apache Arrow implementations or bindings unless those bindings are specifically used via the R package (for example, an R application that embeds a Python interpreter and uses PyArrow to read files from untrusted sources is still vulnerable if the arrow R package is an affected version). It is recommended that users of the arrow R package upgrade to 17.0.0 or later. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to arrow 17.0.0 or later. If using an affected version of the package, untrusted data can read into a Table and its internal to_data_frame() method can be used as a workaround (e.g., read_parquet(..., as_data_frame = FALSE)$to_data_frame()). This issue affects the Apache Arrow R package: from 4.0.0 through 16.1.0. Users are recommended to upgrade to version 17.0.0, which fixes the issue.

Affected products

arrow
  • =<16.1.0

Matching in nixpkgs

pkgs.arrow

Game Narrative Design Tool

pkgs.sparrow

Modern desktop Bitcoin wallet application supporting most hardware wallets and built on common standards such as PSBT, with an emphasis on transparency and usability

pkgs.arrow-cpp

Cross-language development platform for in-memory data

pkgs.sparrow3d

Software renderer for different open handhelds like the gp2x, wiz, caanoo and pandora

pkgs.arrow-glib

GLib bindings for Apache Arrow

pkgs.narrowlink

Self-hosted solution to enable secure connectivity between devices across restricted networks like NAT or firewalls

pkgs.kodiPackages.arrow

Better dates & times for Python

pkgs.haskellPackages.arrows

Arrow classes and transformers

pkgs.liberation-sans-narrow

Liberation Sans Narrow Font Family is a replacement for Arial Narrow

pkgs.python312Packages.arrow

Python library for date manipulation

pkgs.python313Packages.arrow

Python library for date manipulation

pkgs.python312Packages.pyarrow

Cross-language development platform for in-memory data

pkgs.python313Packages.pyarrow

Cross-language development platform for in-memory data

pkgs.typstPackages.xarrow_0_1_0

Variable-length arrows in Typst

pkgs.typstPackages.xarrow_0_1_1

Variable-length arrows in Typst

pkgs.typstPackages.xarrow_0_2_0

Variable-length arrows in Typst

pkgs.typstPackages.xarrow_0_3_0

Variable-length arrows in Typst

pkgs.typstPackages.xarrow_0_3_1

Variable-length arrows in Typst

pkgs.haskellPackages.arrow-utils

functions for working with arrows

pkgs.haskellPackages.arrow-extras

Extra functions for Control.Arrow

pkgs.python312Packages.geoarrow-c

Experimental C and C++ implementation of the GeoArrow specification

pkgs.python313Packages.geoarrow-c

Experimental C and C++ implementation of the GeoArrow specification

pkgs.haskellPackages.pattern-arrows

Arrows for Pretty Printing

pkgs.python312Packages.geoarrow-types

PyArrow types for geoarrow

pkgs.python312Packages.pyarrow-hotfix

Hotfix for the PyArrow security vulnerability CVE-2023-47248

pkgs.python313Packages.geoarrow-types

PyArrow types for geoarrow

pkgs.python313Packages.pyarrow-hotfix

Hotfix for the PyArrow security vulnerability CVE-2023-47248

pkgs.haskellPackages.profunctor-arrows

Profunctor arrows

pkgs.python312Packages.geoarrow-pandas

Python implementation of the GeoArrow specification

pkgs.python313Packages.geoarrow-pandas

Python implementation of the GeoArrow specification

pkgs.python312Packages.geoarrow-pyarrow

PyArrow implementation of geospatial data types

pkgs.python313Packages.geoarrow-pyarrow

PyArrow implementation of geospatial data types

Package maintainers: 35

CVE-2024-52336
7.8 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 3 months ago
Tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root

A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with `script_pre` or `script_post` options that permit arbitrary scripts with their absolute paths to be passed. These user or attacker-controlled executable scripts or programs could then be executed by Tuned with root privileges that could allow attackers to local privilege escalation.

Affected products

tuned
  • <2.24.1
  • *

Matching in nixpkgs

pkgs.tuned

Tuning Profile Delivery Mechanism for Linux

Package maintainers: 3

CVE-2024-11407
created 3 months ago
Denial of Service through Data corruption in gRPC-C++

There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791

Affected products

grpc
  • =<1.66.1

Matching in nixpkgs

pkgs.grpc

C based gRPC (C++, Python, Ruby, Objective-C, PHP, C#)

pkgs.grpcui

Interactive web UI for gRPC, along the lines of postman

pkgs.grpcurl

Like cURL, but for gRPC: Command-line tool for interacting with gRPC servers

pkgs.grpc_cli

Command line tool for interacting with grpc services

pkgs.grpc-tools

Distribution of protoc and the gRPC Node protoc plugin for ease of installation with npm

pkgs.qt6.qtgrpc

Cross-platform application framework for C++

pkgs.grpc-gateway

GRPC to JSON proxy generator plugin for Google Protocol Buffers

pkgs.grpc-client-cli

Generic gRPC command line client

pkgs.grpc-health-check

Minimal, high performance, memory-friendly, safe implementation of the gRPC health checking protocol

pkgs.grpc-health-probe

command-line tool to perform health-checks for gRPC applications

pkgs.kdePackages.qtgrpc

Cross-platform application framework for C++

pkgs.protoc-gen-entgrpc

Generator of an implementation of the service interface for ent protobuff

pkgs.protoc-gen-go-grpc

Go language implementation of gRPC. HTTP/2 based RPC

pkgs.qt6Packages.qtgrpc

Cross-platform application framework for C++

pkgs.protoc-gen-grpc-web

gRPC web support for Google's protocol buffers

pkgs.php81Extensions.grpc

High performance, open source, general RPC framework that puts mobile and HTTP/2 first

pkgs.php82Extensions.grpc

High performance, open source, general RPC framework that puts mobile and HTTP/2 first

pkgs.php83Extensions.grpc

High performance, open source, general RPC framework that puts mobile and HTTP/2 first

pkgs.php84Extensions.grpc

High performance, open source, general RPC framework that puts mobile and HTTP/2 first

pkgs.protoc-gen-grpc-java

gRPC Java Codegen Plugin for Protobuf Compiler

pkgs.protoc-gen-rust-grpc

Protobuf plugin for generating Rust code for gRPC

pkgs.python312Packages.grpcio

HTTP/2-based RPC framework

pkgs.python313Packages.grpcio

HTTP/2-based RPC framework

pkgs.haskellPackages.grpc-spec

Implementation of the pure part of the gRPC spec

pkgs.python312Packages.grpclib

Pure-Python gRPC implementation for asyncio

pkgs.python313Packages.grpclib

Pure-Python gRPC implementation for asyncio

pkgs.python312Packages.grpcio-gcp

gRPC extensions for Google Cloud Platform

pkgs.python313Packages.grpcio-gcp

gRPC extensions for Google Cloud Platform

pkgs.python312Packages.pytest-grpc

Pytest plugin for grpc

pkgs.python313Packages.pytest-grpc

Pytest plugin for grpc

pkgs.python312Packages.grpcio-tools

Protobuf code generator for gRPC

pkgs.python313Packages.grpcio-tools

Protobuf code generator for gRPC

pkgs.python312Packages.clarifai-grpc

Clarifai gRPC API Client

pkgs.python312Packages.grpcio-status

GRPC Python status proto mapping

pkgs.python313Packages.clarifai-grpc

Clarifai gRPC API Client

pkgs.python313Packages.grpcio-status

GRPC Python status proto mapping

pkgs.python312Packages.grpcio-testing

Testing utilities for gRPC Python

pkgs.python313Packages.grpcio-testing

Testing utilities for gRPC Python

pkgs.python312Packages.grpcio-channelz

Channel Level Live Debug Information Service for gRPC

pkgs.python313Packages.grpcio-channelz

Channel Level Live Debug Information Service for gRPC

pkgs.python312Packages.grpc-interceptor

Simplified gRPC interceptors

pkgs.python313Packages.grpc-interceptor

Simplified gRPC interceptors

pkgs.python312Packages.grpcio-reflection

Standard Protobuf Reflection Service for gRPC

pkgs.python313Packages.grpcio-reflection

Standard Protobuf Reflection Service for gRPC

pkgs.python312Packages.grpc-google-iam-v1

GRPC library for the google-iam-v1 service

pkgs.python312Packages.starlink-grpc-core

Core functions for Starlink gRPC communication

pkgs.python313Packages.grpc-google-iam-v1

GRPC library for the google-iam-v1 service

pkgs.python313Packages.starlink-grpc-core

Core functions for Starlink gRPC communication

pkgs.python312Packages.grpcio-health-checking

Standard Health Checking Service for gRPC

pkgs.python313Packages.grpcio-health-checking

Standard Health Checking Service for gRPC

pkgs.python312Packages.opentelemetry-instrumentation-grpc

OpenTelemetry Instrumentation for grpc

pkgs.python313Packages.opentelemetry-instrumentation-grpc

OpenTelemetry Instrumentation for grpc

pkgs.python312Packages.opentelemetry-exporter-otlp-proto-grpc

OpenTelemetry Collector Protobuf over gRPC Exporter

pkgs.python313Packages.opentelemetry-exporter-otlp-proto-grpc

OpenTelemetry Collector Protobuf over gRPC Exporter

CVE-2024-52337
5.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): HIGH
  • Availability impact (A): NONE
created 3 months ago
Tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method

A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick the administrator. The quotes '' are usually used in TuneD logs citing raw user input, so there will always be the ' character ending the spoofed input, and the administrator can easily overlook this. This logged string is later used in logging and in the output of utilities, for example, `tuned-adm get_instances` or other third-party programs that use Tuned's D-Bus interface for such operations.

Affected products

tuned
  • <2.24.1
  • *

Matching in nixpkgs

pkgs.tuned

Tuning Profile Delivery Mechanism for Linux

Package maintainers: 3

CVE-2024-8676
7.4 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): NONE
created 3 months ago
Cri-o: checkpoint restore can be triggered from different namespaces

A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the pod spec, verifying that the pod has access to the mounts it specifies are not applicable to a restored container. This flaw allows a malicious user to trick CRI-O into restoring a pod that doesn't have access to host mounts. The user needs access to the kubelet or cri-o socket to call the restore endpoint and trigger the restore.

Affected products

cri-o
  • <1.31.3
  • <1.29.11
  • *
  • <1.30.8
rhcos
  • *
conmon
container-tools:rhel8/conmon
container-tools:rhel8/podman

Matching in nixpkgs

pkgs.cri-o

Open Container Initiative-based implementation of the Kubernetes Container Runtime Interface

pkgs.conmon

OCI container runtime monitor

pkgs.conmon-rs

OCI container runtime monitor written in Rust

pkgs.cri-o-unwrapped

Open Container Initiative-based implementation of the Kubernetes Container Runtime Interface

Package maintainers: 2

CVE-2024-27134
7.0 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 3 months ago
Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf

Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called.

Affected products

mlflow
  • <2.16.0

Matching in nixpkgs

pkgs.mlflow-server

Open source platform for the machine learning lifecycle

pkgs.python312Packages.mlflow

Open source platform for the machine learning lifecycle

pkgs.python313Packages.mlflow

Open source platform for the machine learning lifecycle

pkgs.python312Packages.sagemaker-mlflow

MLFlow plugin for SageMaker

pkgs.python313Packages.sagemaker-mlflow

MLFlow plugin for SageMaker

Package maintainers: 2

CVE-2024-11586
4.0 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): HIGH
  • Privileges required (PR): HIGH
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 3 months ago
Ubuntu's implementation of pulseaudio can be crashed by a malicious …

Ubuntu's implementation of pulseaudio can be crashed by a malicious program if a bluetooth headset is connected.

Affected products

pulseaudio
  • ==0

Matching in nixpkgs

pkgs.pulseaudio

Sound server for POSIX and Win32 systems

pkgs.pulseaudio-ctl

Control pulseaudio volume from the shell or mapped to keyboard shortcuts. No need for alsa-utils

pkgs.pulseaudioFull

Sound server for POSIX and Win32 systems

pkgs.pulseaudio-dlna

Lightweight streaming server which brings DLNA / UPNP and Chromecast support to PulseAudio and Linux

pkgs.libpulseaudio-vanilla

Sound server for POSIX and Win32 systems

pkgs.pulseaudio-module-xrdp

xrdp sink/source pulseaudio modules

pkgs.libsForQt5.pulseaudio-qt

Pulseaudio bindings for Qt

pkgs.kdePackages.pulseaudio-qt

Qt bindings for libpulse

pkgs.haskellPackages.pulseaudio

A low-level (incomplete) wrapper around the pulseaudio client asynchronous api

pkgs.polybar-pulseaudio-control

Polybar module to control PulseAudio devices, also known as Pavolume

pkgs.xfce.xfce4-pulseaudio-plugin

Adjust the audio volume of the PulseAudio sound system

pkgs.plasma5Packages.pulseaudio-qt

Pulseaudio bindings for Qt

pkgs.tests.pkg-config.defaultPkgConfigPackages.libpulse

Test whether libpulseaudio-17.0 exposes pkg-config modules libpulse

  • nixos-unstable ???
    • nixpkgs-unstable

pkgs.tests.pkg-config.defaultPkgConfigPackages.libpulse-simple

Test whether libpulseaudio-17.0 exposes pkg-config modules libpulse-simple

  • nixos-unstable ???
    • nixpkgs-unstable

pkgs.tests.pkg-config.defaultPkgConfigPackages.libpulse-mainloop-glib

Test whether libpulseaudio-17.0 exposes pkg-config modules libpulse-mainloop-glib

  • nixos-unstable ???
    • nixpkgs-unstable

Package maintainers: 17

CVE-2024-52616
5.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 3 months ago
Avahi: avahi wide-area dns predictable transaction ids

A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.

Affected products

avahi
  • *
  • <0.9
rhcos

Matching in nixpkgs

pkgs.avahi

mDNS/DNS-SD implementation

pkgs.guile-avahi

Bindings to Avahi for GNU Guile

pkgs.avahi-compat

mDNS/DNS-SD implementation

pkgs.haskellPackages.avahi

Minimal DBus bindings for Avahi daemon (http://avahi.org)

pkgs.python312Packages.avahi

mDNS/DNS-SD implementation

pkgs.python313Packages.avahi

mDNS/DNS-SD implementation

Package maintainers: 3

CVE-2024-10295
5.9 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 3 months ago
Gateway: apicast basic auth bypass via malformed base64 headerssending non-base64 'basic' auth with special characters causes apicast to incorrectly authenticate a request

A flaw was found in Gateway. Sending a non-base64 'basic' auth with special characters can cause APICast to incorrectly authenticate a request. A malformed basic authentication header containing special characters bypasses authentication and allows unauthorized access to the backend. This issue can occur due to a failure in the base64 decoding process, which causes APICast to skip the rest of the authentication checks and proceed with routing the request upstream.

Affected products

gateway
  • =<2.14.2
3scale-amp-apicast-gateway-container

Matching in nixpkgs

pkgs.grpc-gateway

GRPC to JSON proxy generator plugin for Google Protocol Buffers

pkgs.janus-gateway

General purpose WebRTC server

pkgs.ingress2gateway

Convert Ingress resources to Gateway API resources

pkgs.firezone-gateway

WireGuard tunnel server for the Firezone zero-trust access platform

pkgs.jetbrains.gateway

Remote development for JetBrains products

pkgs.prometheus-pushgateway

Allows ephemeral and batch jobs to expose metrics to Prometheus

pkgs.chirpstack-gateway-bridge

Gateway Bridge abstracts Packet Forwarder protocols into Protobuf or JSON over MQTT

pkgs.python312Packages.dask-gateway

Client library for interacting with a dask-gateway server

pkgs.python313Packages.dask-gateway

Client library for interacting with a dask-gateway server

pkgs.azure-cli-extensions.arcgateway

Microsoft Azure Command-Line Tools Arcgateway Extension

pkgs.python312Packages.aioruuvigateway

Asyncio-native library for requesting data from a Ruuvi Gateway

pkgs.python312Packages.pyxiaomigateway

Python library to communicate with the Xiaomi Gateway

pkgs.python312Packages.quantum-gateway

Python library for interacting with Verizon Fios Quantum gateway devices

pkgs.python313Packages.aioruuvigateway

Asyncio-native library for requesting data from a Ruuvi Gateway

pkgs.python313Packages.pyxiaomigateway

Python library to communicate with the Xiaomi Gateway

pkgs.python313Packages.quantum-gateway

Python library for interacting with Verizon Fios Quantum gateway devices

pkgs.haskellPackages.amazonka-apigateway

Amazon API Gateway SDK

pkgs.haskellPackages.amazonka-apigatewayv2

Amazon ApiGatewayV2 SDK

pkgs.python312Packages.dask-gateway-server

Multi-tenant server for securely deploying and managing multiple Dask clusters

pkgs.python313Packages.dask-gateway-server

Multi-tenant server for securely deploying and managing multiple Dask clusters

pkgs.haskellPackages.amazonka-backup-gateway

Amazon Backup Gateway SDK

pkgs.haskellPackages.amazonka-storagegateway

Amazon Storage Gateway SDK

pkgs.home-assistant-component-tests.ruuvi_gateway

Open source home automation that puts local control and privacy first

pkgs.home-assistant-component-tests.quantum_gateway

Open source home automation that puts local control and privacy first

pkgs.python312Packages.types-aiobotocore-apigateway

Type annotations for aiobotocore apigateway

pkgs.python313Packages.types-aiobotocore-apigateway

Type annotations for aiobotocore apigateway

pkgs.haskellPackages.amazonka-apigatewaymanagementapi

Amazon ApiGatewayManagementApi SDK

pkgs.home-assistant-custom-components.xiaomi_gateway3

Home Assistant custom component for control Xiaomi Multimode Gateway (aka Gateway 3), Xiaomi Multimode Gateway 2, Aqara Hub E1 on default firmwares over LAN

pkgs.python312Packages.types-aiobotocore-apigatewayv2

Type annotations for aiobotocore apigatewayv2

pkgs.python313Packages.types-aiobotocore-apigatewayv2

Type annotations for aiobotocore apigatewayv2

pkgs.python312Packages.types-aiobotocore-backup-gateway

Type annotations for aiobotocore backup-gateway

pkgs.python312Packages.types-aiobotocore-storagegateway

Type annotations for aiobotocore storagegateway

pkgs.python313Packages.types-aiobotocore-backup-gateway

Type annotations for aiobotocore backup-gateway

pkgs.python313Packages.types-aiobotocore-storagegateway

Type annotations for aiobotocore storagegateway

pkgs.python312Packages.types-aiobotocore-apigatewaymanagementapi

Type annotations for aiobotocore apigatewaymanagementapi

pkgs.python313Packages.types-aiobotocore-apigatewaymanagementapi

Type annotations for aiobotocore apigatewaymanagementapi

CVE-2024-52615
5.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 3 months ago
Avahi: avahi wide-area dns uses constant source port

A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.

Affected products

avahi
  • *
  • <0.9
rhcos

Matching in nixpkgs

pkgs.avahi

mDNS/DNS-SD implementation

pkgs.guile-avahi

Bindings to Avahi for GNU Guile

pkgs.avahi-compat

mDNS/DNS-SD implementation

pkgs.haskellPackages.avahi

Minimal DBus bindings for Avahi daemon (http://avahi.org)

pkgs.python312Packages.avahi

mDNS/DNS-SD implementation

pkgs.python313Packages.avahi

mDNS/DNS-SD implementation

Package maintainers: 3