Nixpkgs security tracker

Permalink CVE-2025-14017

6.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 6 months, 1 week ago by @LeSuisse Activity log

Created suggestion 6 months, 1 week ago
@LeSuisse ignored
11 packages
- wcurl
- curlie
- curlpp
- phpExtensions.curl
- curl-impersonate
- curlWithGnuTls
- curlMinimal
- guile-curl
- curlftpfs
- curlHTTP3
- grpcurl
6 months, 1 week ago
@LeSuisse restored package curlMinimal 6 months, 1 week ago
@LeSuisse ignored
33 packages
- curl-impersonate-ff
- ocamlPackages.curly
- ocamlPackages.ocurl
- tclPackages.tclcurl
- haskellPackages.curl
- luaPackages.lua-curl
- perlPackages.WWWCurl
- php81Extensions.curl
- php82Extensions.curl
- php83Extensions.curl
- haskellPackages.curlhs
- php84Extensions.curl
- lua51Packages.lua-curl
- lua52Packages.lua-curl
- lua53Packages.lua-curl
- lua54Packages.lua-curl
- curl-impersonate-chrome
- luajitPackages.lua-curl
- perl538Packages.WWWCurl
- perl540Packages.WWWCurl
- haskellPackages.hxt-curl
- python312Packages.pycurl
- python313Packages.pycurl
- python312Packages.curlify
- python313Packages.curlify
- tests.pkg-config.defaultPkgConfigPackages.libcurl
- haskellPackages.recurly-client
- haskellPackages.curly-expander
- haskellPackages.curl-cookiejar
- haskellPackages.download-curl
- python313Packages.curl-cffi
- python312Packages.curl-cffi
- typstPackages.curli_0_1_0
6 months, 1 week ago
@LeSuisse deleted
2 maintainers
- @Scrumplex
- @lovek323
6 months, 1 week ago maintainer.delete
@LeSuisse added
14 maintainers
- @GGG-KILLER
- @deliciouslytyped
- @Ma27
- @CrazedProgrammer
- @knl
- @ethancedwards8
- @piotrkwiecinski
- @aanderse
- @talyz
- @chuangzhu
- @fgaz
- @bennofs
- @D4ndellion
- @sternenseemann
6 months, 1 week ago maintainer.add
@LeSuisse deleted
14 maintainers
- @GGG-KILLER
- @deliciouslytyped
- @Ma27
- @CrazedProgrammer
- @knl
- @ethancedwards8
- @piotrkwiecinski
- @aanderse
- @talyz
- @chuangzhu
- @fgaz
- @bennofs
- @D4ndellion
- @sternenseemann
6 months, 1 week ago maintainer.delete
@LeSuisse accepted 6 months, 1 week ago
@LeSuisse published on GitHub 6 months, 1 week ago

broken TLS options for threaded LDAPS

When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.