Nixpkgs Security Tracker

Login with GitHub

Automatically generated suggestions

to slate a suggestion for refinement.

to mark a suggestion as irrelevant and log the reason.

View:
Compact
Detailed
Permalink CVE-2023-5981
5.9 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 6 months ago
Gnutls: timing side-channel in the rsa-psk authentication

A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.

References

Affected products

GnuTLS
  • ==3.8.2
gnutls
  • *
mingw-gnutls
odf4/cephcsi-rhel9
  • *
odf4/odf-cli-rhel9
  • *
odf4/mcg-core-rhel9
  • *
odf4/odf-console-rhel9
  • *
odf4/mcg-rhel9-operator
  • *
odf4/ocs-rhel9-operator
  • *
odf4/odf-rhel9-operator
  • *
odf4/odr-rhel9-operator
  • *
odf4/mcg-operator-bundle
  • *
odf4/ocs-operator-bundle
  • *
odf4/odf-operator-bundle
  • *
odf4/odf-must-gather-rhel9
  • *
odf4/odf-cosi-sidecar-rhel9
  • *
odf4/odr-hub-operator-bundle
  • *
odf4/ocs-client-console-rhel9
  • *
odf4/rook-ceph-rhel9-operator
  • *
odf4/ocs-client-rhel9-operator
  • *
openshift-logging/vector-rhel9
  • *
odf4/ocs-client-operator-bundle
  • *
odf4/ocs-metrics-exporter-rhel9
  • *
openshift-logging/fluentd-rhel9
  • *
odf4/odr-cluster-operator-bundle
  • *
odf4/odf-csi-addons-sidecar-rhel9
  • *
odf4/odf-csi-addons-rhel9-operator
  • *
odf4/odf-csi-addons-operator-bundle
  • *
odf4/odf-multicluster-console-rhel9
  • *
openshift-logging/eventrouter-rhel9
  • *
odf4/odf-multicluster-rhel9-operator
  • *
openshift-logging/logging-loki-rhel9
  • *
odf4/odf-multicluster-operator-bundle
  • *
openshift-logging/loki-rhel9-operator
  • *
openshift-logging/opa-openshift-rhel9
  • *
openshift-logging/elasticsearch6-rhel9
  • *
openshift-logging/loki-operator-bundle
  • *
openshift-logging/logging-curator5-rhel9
  • *
openshift-logging/lokistack-gateway-rhel9
  • *
openshift-logging/elasticsearch-proxy-rhel9
  • *
openshift-logging/logging-view-plugin-rhel9
  • *
openshift-logging/elasticsearch-rhel9-operator
  • *
openshift-logging/elasticsearch-operator-bundle
  • *
openshift-logging/cluster-logging-rhel9-operator
  • *
openshift-logging/log-file-metric-exporter-rhel9
  • *
openshift-logging/cluster-logging-operator-bundle
  • *

Matching in nixpkgs

pkgs.gnutls

GNU Transport Layer Security Library

  • nixos-unstable -

Package maintainers

Permalink CVE-2024-0340
4.4 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): HIGH
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 6 months ago
Kernel: information disclosure in vhost/vhost.c:vhost_new_msg()

A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.

References

Affected products

kernel
  • <6.4-rc6
  • ==6.4-rc6
  • *
kernel-rt
  • *

Matching in nixpkgs

pkgs.linux-doc

Linux kernel html documentation

  • nixos-unstable -

pkgs.coq-kernel

None

  • nixos-unstable -
    • nixpkgs-unstable

pkgs.kernelshark

GUI for trace-cmd which is an interface for the Linux kernel ftrace subsystem

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-6476
6.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 6 months ago
Cri-o: pods are able to break out of resource confinement on cgroupv2

A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node.

References

Affected products

cri-o
  • *
kernel
cri-o:1.21/cri-o

Matching in nixpkgs

pkgs.cri-o

Open Container Initiative-based implementation of the Kubernetes Container Runtime Interface

  • nixos-unstable -

pkgs.cri-o-unwrapped

Open Container Initiative-based implementation of the Kubernetes Container Runtime Interface

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-42753
7.0 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): HIGH
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 6 months ago
Kernel: netfilter: potential slab-out-of-bound access due to integer underflow

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.

References

Affected products

kernel
  • ==6.6-rc1
  • *
kernel-rt
  • *
kpatch-patch

Matching in nixpkgs

pkgs.linux-doc

Linux kernel html documentation

  • nixos-unstable -

pkgs.coq-kernel

None

  • nixos-unstable -
    • nixpkgs-unstable

pkgs.kernelshark

GUI for trace-cmd which is an interface for the Linux kernel ftrace subsystem

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-46846
9.3 CRITICAL
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 6 months ago
Squid: request/response smuggling in http/1.1 and icap

SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems.

References

Affected products

squid
  • *
  • <6.4
  • ==6.4
squid34
squid:4
  • *

Matching in nixpkgs

pkgs.squid

Caching proxy for the Web supporting HTTP, HTTPS, FTP, and more

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-7008
5.9 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): HIGH
  • Availability impact (A): NONE
created 6 months ago
Systemd-resolved: unsigned name response in signed zone is not refused when dnssec=yes

A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.

References

Affected products

systemd
  • ==25X
  • *

Matching in nixpkgs

pkgs.udev

System and service manager for Linux

  • nixos-unstable -

pkgs.systemd

System and service manager for Linux

  • nixos-unstable -

pkgs.systemd-lsp

Language server implementation for systemd unit files made in Rust

  • nixos-unstable -

pkgs.systemdLibs

System and service manager for Linux

  • nixos-unstable -

pkgs.rofi-systemd

Control your systemd units using rofi

  • nixos-unstable -

pkgs.systemdUkify

System and service manager for Linux

  • nixos-unstable -

pkgs.check_systemd

Nagios / Icinga monitoring plugin to check systemd for failed units

  • nixos-unstable -

pkgs.systemd-netlogd

Forwards messages from the journal to other hosts over the network

  • nixos-unstable -

pkgs.systemd-lock-handler

Translates systemd-system lock/sleep signals into systemd-user target activations

  • nixos-unstable -

pkgs.update-systemd-resolved

Helper script for OpenVPN to directly update the DNS settings of a link through systemd-resolved via DBus

  • nixos-unstable -
Permalink CVE-2024-21747
7.6 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): HIGH
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): LOW
created 6 months ago
WordPress WP ERP Plugin <= 1.12.8 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting.This issue affects WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: from n/a through 1.12.8.

References

Affected products

erp
  • =<1.12.8

Matching in nixpkgs

pkgs.lerpn

Curses RPN calculator written in straight Python

pkgs.serpl

Simple terminal UI for search and replace, ala VS Code

  • nixos-unstable -

pkgs.sherpa

Monte Carlo event generator for the Simulation of High-Energy Reactions of PArticles

  • nixos-unstable -

pkgs.makerpm

Clean, simple RPM packager reimplemented completely from scratch

  • nixos-unstable -

pkgs.serpent

Compiler for the Serpent language for Ethereum

pkgs.overpass

Font heavily inspired by Highway Gothic

  • nixos-unstable -

pkgs.overpush

Self-hosted, drop-in replacement for Pushover that can use XMPP

  • nixos-unstable -

pkgs.powerpipe

Dynamically query your cloud, code, logs & more with SQL

  • nixos-unstable -

pkgs.featherpad

Lightweight Qt5 Plain-Text Editor for Linux

  • nixos-unstable -

pkgs.filterpath

Retrieve a valid path from a messy piped line

  • nixos-unstable -
    • nixpkgs-unstable

pkgs.ciderpress2

File archive utility for Apple II disk images and file archives

  • nixos-unstable -

pkgs.letterpress

Create beautiful ASCII art

  • nixos-unstable -

pkgs.pufferpanel

Free, open source game management panel

  • nixos-unstable -

pkgs.fingerprintx

Standalone utility for service discovery on open ports

  • nixos-unstable -

pkgs.hyperpotamus

YAML based HTTP script processing engine

  • nixos-unstable -

pkgs.etherpad-lite

Modern really-real-time collaborative document editor

  • nixos-unstable -

pkgs.open-interpreter

OpenAI's Code Interpreter in your terminal, running locally

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-5824
7.5 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 6 months ago
Squid: dos against http and https

Squid is vulnerable to Denial of Service attack against HTTP and HTTPS clients due to an Improper Handling of Structural Elements bug.

References

Affected products

squid
  • *
  • ==6.4
squid:4
  • *

Matching in nixpkgs

pkgs.squid

Caching proxy for the Web supporting HTTP, HTTPS, FTP, and more

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-6560
5.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 6 months ago
Kernel: io_uring out of boundary memory access in __io_uaddr_map()

An out-of-bounds memory access flaw was found in the io_uring SQ/CQ rings functionality in the Linux kernel. This issue could allow a local user to crash the system.

References

Affected products

kernel
  • ==6.7-rc5
kernel-rt

Matching in nixpkgs

pkgs.linux-doc

Linux kernel html documentation

  • nixos-unstable -

pkgs.coq-kernel

None

  • nixos-unstable -
    • nixpkgs-unstable

pkgs.kernelshark

GUI for trace-cmd which is an interface for the Linux kernel ftrace subsystem

  • nixos-unstable -

Package maintainers

Permalink CVE-2022-3328
7.8 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): HIGH
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 6 months ago
Race condition in snap-confine's must_mkdir_and_open_with_perms()

Race condition in snap-confine's must_mkdir_and_open_with_perms()

References

Affected products

snapd
  • <2.61.1

Matching in nixpkgs