Nixpkgs security tracker
NIXPKGS-2026-1164
GitHub issue
published on
Permalink
CVE-2026-28224
8.2 HIGH
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): NONE
- Integrity impact (I): LOW
- Availability impact (A): HIGH
by @LeSuisse Activity log
- Created automatic suggestion
- @LeSuisse ignored package firebird-emu
- @LeSuisse ignored
- @LeSuisse accepted
- @LeSuisse published on GitHub
Firebird Null Pointer Dereference via CryptCallback causes DOS
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when the server receives an op_crypt_key_callback packet without prior authentication, the port_server_crypt_callback handler is not initialized, resulting in a null pointer dereference and server crash. An unauthenticated attacker who knows only the server's IP and port can exploit this to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
References
-
https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-xrcw-wpjx-pr95 x_refsource_CONFIRM
Ignored references (3)
-
https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4 x_refsource_MISC
-
https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7 x_refsource_MISC
-
https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14 x_refsource_MISC
Affected products
firebird
- ==>= 5.0.0, < 5.0.4
- ==>= 3.0.0, < 3.0.14
- ==>= 4.0.0, < 4.0.7
Matching in nixpkgs
pkgs.firebird
SQL relational database management system
pkgs.firebird_3
SQL relational database management system
Package maintainers
-
@MarcWeber Marc Weber <marco-oweber@gmx.de>
-
@bbenno Benno Bielmeier <nix@bbenno.com>