Nixpkgs security tracker

Login with GitHub

Suggestion detail

Dismissed
Permalink CVE-2026-31801
7.7 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): None (N)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 2 months, 2 weeks ago by @mweinelt Activity log
  • Created suggestion 2 months, 2 weeks ago
  • @mweinelt ignored
    6 packages
    • zotero
    • zotify
    • zotero_7
    • zotero-beta
    • haskellPackages.zot
    • zotero-translation-server
    2 months, 2 weeks ago
  • @mweinelt dismissed 2 months, 2 weeks ago
zot create-only policy allows overwrite attempts of existing latest tag (update permission not required)

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/{name}/manifests/{reference} as create by default, and only switches to update when the tag already exists and reference != "latest". As a result, when latest already exists, a user who is allowed to create (but not allowed to update) can still pass the authorization check for an overwrite attempt of latest. This vulnerability is fixed in 2.1.15.

Affected products

zot
  • ==>= 1.3.0, < v2.1.15
Ignored packages (6)

pkgs.zotero

Collect, organize, cite, and share your research sources

pkgs.zotify

Fast and customizable music and podcast downloader

pkgs.zotero_7

Collect, organize, cite, and share your research sources

Not in nixpkgs