3 results (0.002 seconds)

CVSS: 8.4EPSS: 0%CPEs: 7EXPL: 0

CVE-2024-51481 – Nix allows macOS sandbox escape via built-in builders

https://notcve.org/view.php?id=CVE-2024-51481

31 Oct 2024 — Nix is a package manager for Linux and other Unix systems. On macOS, built-in builders (such as `builtin:fetchurl`, exposed to users with `import `) were not executed in the macOS sandbox. Thus, these builders (which are running under the `nixbld*` users) had read access to world-readable paths and write access to world-writable paths outside of the sandbox. This issue is fixed in 2.18.9, 2.19.7, 2.20.9, 2.21.5, 2.22.4, 2.23.4, and 2.24.10. Note that sandboxing is not enabled by default on... • https://github.com/NixOS/nix/commit/597fcc98e18e3178734d06a9e7306250e8cb8d74 • CWE-693: Protection Mechanism Failure •

CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 0

CVE-2024-47174 – Credential leak when credentials are used with `<nix/fetchurl.nix>`

https://notcve.org/view.php?id=CVE-2024-47174

26 Sep 2024 — Nix is a package manager for Linux and other Unix systems. Starting in version 1.11 and prior to versions 2.18.8 and 2.24.8, `` did not verify TLS certificates on HTTPS connections. This could lead to connection details such as full URLs or credentials leaking in case of a man-in-the-middle (MITM) attack. `` is also known as the builtin derivation builder `builtin:fetchurl`. It's not to be confused with the evaluation-time function `builtins.fetchurl`, which was not affec... • https://github.com/NixOS/nix/commit/062b4a489e30da9c85fa4ff15cfdd2e51cac7b90 • CWE-287: Improper Authentication •

CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0

CVE-2024-45593 – Nix affected by unsafe NAR unpacking

https://notcve.org/view.php?id=CVE-2024-45593

10 Sep 2024 — Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root permissions when using the Nix daemon. This issue is fixed in Nix 2.24.6. • https://github.com/NixOS/nix/commit/eb11c1499876cd4c9c188cbda5b1003b36ce2e59 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •