Nixpkgs security tracker
7.4 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed solely by a client-chosen `session_id` with no binding to the authenticated user — a control the WebSocket transport has but that was dropped on SSE. An attacker who learns (or a victim who leaks) a `session_id` could connect to the message endpoint and dispatch event handlers that execute with the victim's identity and state. This is fixed in djust 1.0.7. Each SSE session is bound to its owning principal at creation and cross-principal access is rejected; SSE session creation is additionally capped per principal. As a workaround, disable the SSE transport.
References
-
https://github.com/djust-org/djust/security/advisories/GHSA-f795-p5jw-j6g2 x_refsource_CONFIRM
-
https://github.com/djust-org/djust/releases/tag/v1.0.7 x_refsource_MISC
Affected products
- ==< 1.0.7
Matching in nixpkgs
pkgs.python313Packages.adjusttext
Iteratively adjust text position in matplotlib plots to minimize overlaps
pkgs.python314Packages.adjusttext
Iteratively adjust text position in matplotlib plots to minimize overlaps
pkgs.ankiAddons.adjust-sound-volume
Add a new menu item for adjusting the sound volume
pkgs.gnomeExtensions.displays-adjustments
Offers sliders to control external displays' brightness and contrast through DDC. Extension requires ddcutil-service to be installed.
pkgs.vscode-extensions.dendron.adjust-heading-level
VSCode extension to adjust the heading level of the selected text
pkgs.gnomeExtensions.blur-wallpaper-with-adjustable-intensity
Creates a static blurred copy of your current desktop wallpaper for better performance and artifact-free workspace switching. Set intensity from 0 to 300 and wait a moment. Note: ImageMagick (the `magick` command) must be installed.
Package maintainers
-
@junestepp June Stepp <git@junestepp.me>
-
@honnip Jung seungwoo <me@honnip.page>
-
@samuela Samuel Ainsworth <skainsworth@gmail.com>
-
@hexadecimalDinosaur Ivy Fan-Chiang <dev@ivyfanchiang.ca>