Nixpkgs security tracker
3.5 LOW
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): Required (R)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): Low (L)
- Availability (A): None (N)
- Exploit Code Maturity (E): Proof-of-Concept (P)
- Remediation Level (RL): Not Defined (X)
- Report Confidence (RC): Reasonable (R)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): Required (R)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): None (N)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
13 packages
- busybox
- gobusybox
- busybox-sandbox-shell
- python312Packages.busypie
- python313Packages.busypie
- python314Packages.busypie
- minimal-bootstrap.busybox-static
- python312Packages.busylight-core
- python313Packages.busylight-core
- python314Packages.busylight-core
- python312Packages.busylight-for-humans
- python313Packages.busylight-for-humans
- python314Packages.busylight-for-humans
- @LeSuisse dismissed
busy Callback app.js redirect
A flaw has been found in busy up to 2.5.5. The affected element is an unknown function of the file source-code/busy-master/src/server/app.js of the component Callback Handler. Executing a manipulation of the argument state can lead to open redirect. It is possible to launch the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
References
-
-
-
Submit #753299 | busyorg busy <=2.5.5 Open Redirect third-party-advisory
-
https://github.com/busyorg/busy/issues/2287 issue-tracking
-
Affected products
- ==2.5.3
- ==2.5.4
- ==2.5.0
- ==2.5.1
- ==2.5.2
- ==2.5.5
Ignored packages (13)
pkgs.busybox
Tiny versions of common UNIX utilities in a single small executable
pkgs.gobusybox
Tools for compiling many Go commands into one binary to save space
-
nixos-unstable 0.2.0-unstable-2024-03-05
- nixpkgs-unstable 0.2.0-unstable-2024-03-05
- nixos-unstable-small 0.2.0-unstable-2024-03-05
pkgs.busybox-sandbox-shell
Tiny versions of common UNIX utilities in a single small executable
pkgs.python312Packages.busypie
None
pkgs.python313Packages.busypie
Expressive busy wait for Python
pkgs.python314Packages.busypie
Expressive busy wait for Python
pkgs.minimal-bootstrap.busybox-static
Tiny versions of common UNIX utilities in a single small executable
pkgs.python312Packages.busylight-core
None
pkgs.python313Packages.busylight-core
Library for interacting programmatically with USB-connected LED lights
pkgs.python314Packages.busylight-core
Library for interacting programmatically with USB-connected LED lights
pkgs.python312Packages.busylight-for-humans
None
pkgs.python313Packages.busylight-for-humans
Control USB connected presence lights from multiple vendors via the command-line or web API
pkgs.python314Packages.busylight-for-humans
Control USB connected presence lights from multiple vendors via the command-line or web API