NIXPKGS-2026-0952
GitHub issue
published on
Permalink
CVE-2026-3184
3.7 LOW
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): HIGH
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): NONE
- Integrity impact (I): LOW
- Availability impact (A): NONE
by @LeSuisse Activity log
- Created automatic suggestion
- @LeSuisse removed package more
- @LeSuisse removed package wall
- @LeSuisse removed package mount
- @LeSuisse removed package eject
- @LeSuisse removed package umount
- @LeSuisse removed package logger
- @LeSuisse removed package hexdump
- @LeSuisse removed package libuuid
- @LeSuisse removed package libsmartcols
- @LeSuisse removed package unixtools.col
- @LeSuisse removed package unixtools.fsck
- @LeSuisse removed package unixtools.more
- @LeSuisse removed package unixtools.wall
- @LeSuisse removed package unixtools.eject
- @LeSuisse removed package unixtools.fdisk
- @LeSuisse removed package unixtools.mount
- @LeSuisse removed package unixtools.write
- @LeSuisse removed package unixtools.column
- @LeSuisse removed package unixtools.getopt
- @LeSuisse removed package unixtools.logger
- @LeSuisse removed package unixtools.script
- @LeSuisse removed package unixtools.umount
- @LeSuisse removed package unixtools.hexdump
- @LeSuisse removed package unixtools.whereis
- @LeSuisse removed package util-linuxMinimal
- @LeSuisse removed package uutils-util-linux
- @LeSuisse removed package unixtools.util-linux
- @LeSuisse ignored reference https://a…
- @LeSuisse accepted
- @LeSuisse published on GitHub
Util-linux: util-linux: access control bypass due to improper hostname canonicalization
A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.
References
Ignored references (1)
Affected products
rhcos
util-linux
Matching in nixpkgs
pkgs.utillinux
Set of system utilities for Linux
Ignored packages (27)
pkgs.more
None
pkgs.wall
None
pkgs.eject
None
pkgs.mount
None
pkgs.logger
None
pkgs.umount
None
pkgs.hexdump
None
pkgs.libuuid
Set of system utilities for Linux
pkgs.libsmartcols
Set of system utilities for Linux
pkgs.unixtools.col
None
pkgs.unixtools.fsck
None
pkgs.unixtools.more
None
pkgs.unixtools.wall
None
pkgs.unixtools.eject
None
pkgs.unixtools.fdisk
None
pkgs.unixtools.mount
None
pkgs.unixtools.write
None
pkgs.unixtools.column
None
pkgs.unixtools.getopt
None
pkgs.unixtools.logger
None
pkgs.unixtools.script
None
pkgs.unixtools.umount
None
pkgs.unixtools.hexdump
None
pkgs.unixtools.whereis
None
pkgs.util-linuxMinimal
Set of system utilities for Linux
pkgs.uutils-util-linux
Rust reimplementation of the util-linux project
-
nixos-unstable 0.0.1-unstable-2026-03-13
- nixpkgs-unstable 0.0.1-unstable-2026-03-13
- nixos-unstable-small 0.0.1-unstable-2026-03-13
pkgs.unixtools.util-linux
None
-
nixos-unstable 1003.1-2008
- nixpkgs-unstable 1003.1-2008
- nixos-unstable-small 1003.1-2008
-
nixos-25.11 1003.1-2008
- nixos-25.11-small 1003.1-2008
- nixpkgs-25.11-darwin 1003.1-2008
Package maintainers
-
@numinit Morgan Jones <me+nixpkgs@numin.it>