535 matches found
CVE-2024-45593
CVE-2024-45593 affects the Nix package manager. A bug in Nix 2.24 prior to 2.24.6 lets a substituter or malicious user craft a NAR that, when unpacked by Nix, writes to arbitrary filesystem locations accessible to the Nix process, with root privileges when using the Nix daemon. Multiple connected...
CVE-2024-45593 Nix affected by unsafe NAR unpacking
Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root...
CVE-2024-45593
Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root...
CVE-2024-45593 Nix affected by unsafe NAR unpacking
Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root...
CVE-2024-45593 Nix affected by unsafe NAR unpacking
Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root...
CVE-2024-45845
Rejected reason: DO NOT USE THIS CVE RECORD. Consult IDs: CVE-2024-45593. Reason: This record is a reservation duplicate of CVE-2024-45593. Notes: All CVE users should reference CVE-2024-45593 instead of this record. All references and descriptions in this record have been removed to prevent...
CVE-2024-45845
Rejected reason: DO NOT USE THIS CVE RECORD. Consult IDs: CVE-2024-45593. Reason: This record is a reservation duplicate of CVE-2024-45593. Notes: All CVE users should reference CVE-2024-45593 instead of this record. All references and descriptions in this record have been removed to prevent...
编号撤回
Nix is a powerful package manager from the Nix open source. It is used for making packages. This CVE number has been withdrawn...
PT-2024-9884
Name of the Vulnerable Software and Affected Versions: Nix versions 2.24 through 2.24.5 Nix version 2.24 prior to 2.24.6 Description: A bug in Nix allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the...
Nix 安全漏洞
Nix is a powerful package manager from the Nix open source. It is used for making packages. A security vulnerability exists in Nix versions 2.24.0 through 2.24.5, which stems from a vulnerability that allows an alternate or malicious user to craft a NAR, resulting in the right to access arbitrary...
CVE-2024-45593: Improper Limitation of a Pathname to a Restricted Directory
Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root...
PT-2024-31807
Name of the Vulnerable Software and Affected Versions: nix versions 2.24 through 2.24.5 Description: The issue allows directory traversal via a symlink in a nar file due to mishandling of a directory containing a symlink and a directory of the same name. Recommendations: For versions 2.24 through...
RPC Denial of Service targeting *nix rpcbind/libtirpc
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'RPC DoS targeting nix rpcbind/libtirpc', 'Description' = %q This module exploits a vulnerability in certain versions of rpcbind, LIBTIRPC, and...
CVE-2024-45049 Nix Hydra Missing authentication when triggering evaluations
Hydra is a Continuous Integration service for Nix based projects. It is possible to trigger evaluations in Hydra without any authentication. Depending on the size of evaluations, this can impact the availability of systems. The problem can be fixed by applying...
CVE-2024-45049 Nix Hydra Missing authentication when triggering evaluations
Hydra is a Continuous Integration service for Nix based projects. It is possible to trigger evaluations in Hydra without any authentication. Depending on the size of evaluations, this can impact the availability of systems. The problem can be fixed by applying...
CVE-2024-45049
CVE-2024-45049 affects Hydra, a CI service for Nix-based projects. The issue allows triggering evaluations without authentication, with potential impact to system availability depending on evaluation size. The advisory provides a fix: apply the commit f73043378907c2c7e44f633ad764c8bdd1c947d5 to H...
Hydra 安全漏洞
Hydra is a Nix open source continuous integration service based on the Nix project. A security vulnerability exists in Hydra that stems from an evaluation that can be triggered in Hydra without any authentication...
CVE-2024-45049: Missing Authentication for Critical Function
Hydra is a Continuous Integration service for Nix based projects. It is possible to trigger evaluations in Hydra without any authentication. Depending on the size of evaluations, this can impact the availability of systems. The problem can be fixed by applying...