CVE-2024-36050

2024-05-1800:00:00

ubuntu.com

nix

hash cache

vulnerability

source code

pull request

7.2 High

AI Score

Confidence

Low

JSON

Nix through 2.22.1 mishandles certain usage of hash caches, which makes it
easier for attackers to replace current source code with
attacker-controlled source code by luring a maintainer into accepting a
malicious pull request.

OSVersionArchitecturePackageVersionFilename
ubuntu22.04noarchnix< anyUNKNOWN
ubuntu23.10noarchnix< anyUNKNOWN
ubuntu24.04noarchnix< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	22.04	noarch	nix	< any	UNKNOWN
ubuntu	23.10	noarch	nix	< any	UNKNOWN
ubuntu	24.04	noarch	nix	< any	UNKNOWN

References

github.com/NixOS/nix/issues/969

github.com/NixOS/ofborg/issues/68#issuecomment-2082789441

launchpad.net/bugs/cve/CVE-2024-36050

nvd.nist.gov/vuln/detail/CVE-2024-36050

security-tracker.debian.org/tracker/CVE-2024-36050

www.cve.org/CVERecord?id=CVE-2024-36050

7.2 High

AI Score

Confidence

Low

JSON

Related for UB:CVE-2024-36050