Nixpkgs Security Tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Automatically generated suggestions

to queue a suggestion for refinement.

to remove a suggestion from the queue.

CVE-2023-51702
6.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 10 months ago
Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service

Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configuration dictionary will be logged as plain text in the triggerer service without masking. This allows anyone with access to the metadata or triggerer log to obtain the configuration file and use it to access the Kubernetes cluster. This behavior was changed in version 7.0.0, which stopped serializing the file contents and started providing the file path instead to read the contents into the trigger. Users are recommended to upgrade to version 7.0.0, which fixes this issue.

Affected products

apache-airflow
  • <2.6.1
apache-airflow-providers-cncf-kubernetes
  • <7.0.0

Matching in nixpkgs

pkgs.apache-airflow

Programmatically author, schedule and monitor data pipelines

Package maintainers: 3

CVE-2024-27318
7.5 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 10 months ago
Versions of the package onnx before and including 1.15.0 are …

Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory. The vulnerability occurs as a bypass for the patch added for CVE-2022-25882.

Affected products

onnx
  • =<1.15.0

Matching in nixpkgs

pkgs.onnxruntime

Cross-platform, high performance scoring engine for ML models

pkgs.python311Packages.onnx

Open Neural Network Exchange

pkgs.python312Packages.onnx

Open Neural Network Exchange

pkgs.python311Packages.onnxmltools

ONNXMLTools enables conversion of models to ONNX

pkgs.python311Packages.onnxruntime

Cross-platform, high performance scoring engine for ML models

pkgs.python312Packages.onnxmltools

ONNXMLTools enables conversion of models to ONNX

pkgs.python312Packages.onnxruntime

Cross-platform, high performance scoring engine for ML models

pkgs.python311Packages.onnxruntime-tools

Transformers Model Optimization Tool of ONNXRuntime

pkgs.python312Packages.onnx.x86_64-linux

Open Neural Network Exchange

pkgs.python312Packages.onnxruntime-tools

Transformers Model Optimization Tool of ONNXRuntime

pkgs.python312Packages.onnx.aarch64-linux

Open Neural Network Exchange

pkgs.python312Packages.onnx.x86_64-darwin

Open Neural Network Exchange

pkgs.python312Packages.onnx.aarch64-darwin

Open Neural Network Exchange

pkgs.python311Packages.onnxconverter-common

ONNX Converter and Optimization Tools

pkgs.python311Packages.rapidocr-onnxruntime

Cross platform OCR Library based on OnnxRuntime

pkgs.python312Packages.onnxconverter-common

ONNX Converter and Optimization Tools

pkgs.python312Packages.rapidocr-onnxruntime

Cross platform OCR Library based on OnnxRuntime

pkgs.python312Packages.skl2onnx.x86_64-linux

Convert scikit-learn models to ONNX

pkgs.python312Packages.skl2onnx.aarch64-linux

Convert scikit-learn models to ONNX

pkgs.python312Packages.skl2onnx.x86_64-darwin

Convert scikit-learn models to ONNX

pkgs.python312Packages.skl2onnx.aarch64-darwin

Convert scikit-learn models to ONNX

pkgs.python312Packages.onnxmltools.x86_64-linux

ONNXMLTools enables conversion of models to ONNX

pkgs.python312Packages.onnxruntime.x86_64-linux

Cross-platform, high performance scoring engine for ML models

pkgs.python312Packages.onnxmltools.aarch64-linux

ONNXMLTools enables conversion of models to ONNX

pkgs.python312Packages.onnxmltools.x86_64-darwin

ONNXMLTools enables conversion of models to ONNX

pkgs.python312Packages.onnxruntime.aarch64-linux

Cross-platform, high performance scoring engine for ML models

pkgs.python312Packages.onnxruntime.x86_64-darwin

Cross-platform, high performance scoring engine for ML models

pkgs.python312Packages.onnxmltools.aarch64-darwin

ONNXMLTools enables conversion of models to ONNX

pkgs.python312Packages.onnxruntime.aarch64-darwin

Cross-platform, high performance scoring engine for ML models

pkgs.python312Packages.onnxruntime-tools.x86_64-linux

Transformers Model Optimization Tool of ONNXRuntime

pkgs.python312Packages.onnxruntime-tools.aarch64-linux

Transformers Model Optimization Tool of ONNXRuntime

pkgs.python312Packages.onnxruntime-tools.x86_64-darwin

Transformers Model Optimization Tool of ONNXRuntime

pkgs.python312Packages.onnxruntime-tools.aarch64-darwin

Transformers Model Optimization Tool of ONNXRuntime

pkgs.python312Packages.onnxconverter-common.x86_64-linux

ONNX Converter and Optimization Tools

pkgs.python312Packages.rapidocr-onnxruntime.x86_64-linux

Cross platform OCR Library based on OnnxRuntime

pkgs.python312Packages.onnxconverter-common.aarch64-linux

ONNX Converter and Optimization Tools

pkgs.python312Packages.onnxconverter-common.x86_64-darwin

ONNX Converter and Optimization Tools

pkgs.python312Packages.rapidocr-onnxruntime.x86_64-darwin

Cross platform OCR Library based on OnnxRuntime

pkgs.python312Packages.onnxconverter-common.aarch64-darwin

ONNX Converter and Optimization Tools

pkgs.python312Packages.rapidocr-onnxruntime.aarch64-darwin

Cross platform OCR Library based on OnnxRuntime

Package maintainers: 6

CVE-2023-1183
5.0 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): HIGH
  • Availability impact (A): NONE
created 10 months ago
Arbitrary file write

A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker.

Affected products

libreoffice

Matching in nixpkgs

pkgs.libreoffice-bin

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.hyphenDicts.de_AT

Hyphen dictionary for German (Austria) from LibreOffice

pkgs.hyphenDicts.de_CH

Hyphen dictionary for German (Switzerland) from LibreOffice

pkgs.hyphenDicts.de_DE

Hyphen dictionary for German (Germany) from LibreOffice

pkgs.hunspellDicts.cs_CZ

Hunspell dictionary for Czech (Czechia) from LibreOffice

pkgs.hunspellDicts.el_GR

Hunspell dictionary for Greek (Greece) from LibreOffice

pkgs.hunspellDicts.he_IL

Hunspell dictionary for Hebrew (Israel) from LibreOffice

pkgs.hunspellDicts.hr_HR

Hunspell dictionary for Croatian (Croatia) from LibreOffice

pkgs.hunspellDicts.hu_HU

Hunspell dictionary for Hungarian (Hungary) from LibreOffice

pkgs.hunspellDicts.id_id

Hunspell dictionary for Bahasa Indonesia (Indonesia) from LibreOffice

pkgs.hunspellDicts.nb_NO

Hunspell dictionary for Norwegian Bokmål (Norway) from LibreOffice

pkgs.hunspellDicts.nn_NO

Hunspell dictionary for Norwegian Nynorsk (Norway) from LibreOffice

pkgs.hunspellDicts.pl_PL

Hunspell dictionary for Polish (Poland) from LibreOffice

pkgs.hunspellDicts.pt_BR

Hunspell dictionary for Portuguese (Brazil) from LibreOffice

pkgs.hunspellDicts.pt_PT

Hunspell dictionary for Portuguese (Portugal) from LibreOffice

pkgs.hunspellDicts.ru_RU

Hunspell dictionary for Russian (Russian) from LibreOffice

pkgs.hunspellDicts.sk_SK

Hunspell dictionary for Slovak (Slovakia) from LibreOffice

pkgs.libreoffice-collabora

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-unwrapped

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-qt6-unwrapped

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-fresh-unwrapped

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-bin.x86_64-darwin

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-bin.aarch64-darwin

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-fresh.x86_64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-qt-fresh-unwrapped

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-still.x86_64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-fresh.aarch64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-qt6-fresh-unwrapped

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-qt6-still-unwrapped

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-still.aarch64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-qt-fresh.x86_64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-qt-still.x86_64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-collabora.x86_64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-qt-fresh.aarch64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-qt-still.aarch64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-qt6-fresh.x86_64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-qt6-still.x86_64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-unwrapped.x86_64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-collabora.aarch64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-qt6-fresh.aarch64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-qt6-still.aarch64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-unwrapped.aarch64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-qt6-unwrapped.x86_64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-qt6-unwrapped.aarch64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-fresh-unwrapped.x86_64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-fresh-unwrapped.aarch64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-qt-fresh-unwrapped.x86_64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-qt-fresh-unwrapped.aarch64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-qt6-fresh-unwrapped.x86_64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-qt6-still-unwrapped.x86_64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-qt6-fresh-unwrapped.aarch64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

pkgs.libreoffice-qt6-still-unwrapped.aarch64-linux

Comprehensive, professional-quality productivity suite, a variant of openoffice.org

Package maintainers: 4

CVE-2023-42792
created 10 months ago
Apache Airflow: Improper access control to DAG resources

Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't. Users of Apache Airflow are strongly advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.

Affected products

apache-airflow
  • <2.7.2

Matching in nixpkgs

pkgs.apache-airflow

Programmatically author, schedule and monitor data pipelines

Package maintainers: 3

CVE-2023-38253
4.7 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 10 months ago
W3m: out of bounds read in growbuf_to_str() at w3m/indep.c

An out-of-bounds read flaw was found in w3m, in the growbuf_to_Str function in indep.c. This issue may allow an attacker to cause a denial of service through a crafted HTML file.

Affected products

w3m

Matching in nixpkgs

Package maintainers: 1

CVE-2023-32629
7.8 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 10 months ago
Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip …

Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_setxattr on Ubuntu kernels

Affected products

Linux
  • <6.2.0-26.26
  • <5.4.0-155.172
  • <6.0.0-1020.20

Matching in nixpkgs

pkgs.vibrantlinux

Tool to automate managing your screen's saturation depending on what programs are running

pkgs.perl538Packages.LinuxFD

Linux specific special filehandles

pkgs.perl540Packages.LinuxFD

Linux specific special filehandles

pkgs.perl538Packages.LinuxACL

Perl extension for reading and setting Access Control Lists for files by libacl linux library

pkgs.perl540Packages.LinuxACL

Perl extension for reading and setting Access Control Lists for files by libacl linux library

pkgs.perl538Packages.Linuxusermod

This module adds, removes and modify user and group accounts according to the passwd and shadow files syntax

pkgs.perl540Packages.Linuxusermod

This module adds, removes and modify user and group accounts according to the passwd and shadow files syntax

pkgs.perl538Packages.LinuxDesktopFiles

Fast parsing of the Linux desktop files

pkgs.perl538Packages.LinuxDistribution

Perl extension to detect on which Linux distribution we are running

pkgs.perl540Packages.LinuxDesktopFiles

Fast parsing of the Linux desktop files

pkgs.perl540Packages.LinuxDistribution

Perl extension to detect on which Linux distribution we are running

pkgs.samsung-unified-linux-driver_4_01_17

Samsung's Linux printing drivers; includes binaries without source code

pkgs.samsung-unified-linux-driver_4_01_17.x86_64-linux

Samsung's Linux printing drivers; includes binaries without source code

pkgs.samsung-unified-linux-driver_4_01_17.aarch64-linux

Samsung's Linux printing drivers; includes binaries without source code

Package maintainers: 6

CVE-2023-7207
4.9 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): HIGH
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 10 months ago
Debian's cpio contains a path traversal vulnerability. This issue was …

Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstream has since provided a proper fix to --no-absolute-filenames.

Affected products

cpio
  • <2.14+dfsg-1

Matching in nixpkgs

pkgs.cpio

Program to create or extract from cpio archives

pkgs.mkinitcpio-nfs-utils

ipconfig and nfsmount tools for root on NFS, ported from klibc

pkgs.emacsPackages.cpio-mode

Package maintainers: 1

CVE-2024-31869
5.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 10 months ago
Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used

Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.expose_config" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your "expose_config" configuration to False as a workaround. This is similar, but different to CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq which concerned API, not UI configuration page.

Affected products

apache-airflow
  • =<2.8.4

Matching in nixpkgs

pkgs.apache-airflow

Programmatically author, schedule and monitor data pipelines

Package maintainers: 3

CVE-2023-46215
7.5 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 10 months ago
Apache Airflow Celery provider, Apache Airflow: Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend

Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend Note: the vulnerability is about the information exposed in the logs not about accessing the logs. This issue affects Apache Airflow Celery provider: from 3.3.0 through 3.4.0; Apache Airflow: from 1.10.0 through 2.6.3. Users are recommended to upgrade Airflow Celery provider to version 3.4.1 and Apache Airlfow to version 2.7.0 which fixes the issue.

Affected products

apache-airflow
  • <2.7.0
apache-airflow-providers-celery
  • =<3.4.0

Matching in nixpkgs

pkgs.apache-airflow

Programmatically author, schedule and monitor data pipelines

Package maintainers: 3

CVE-2024-32077
5.4 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 10 months ago
Apache Airflow: XSS vulnerability in Task Instance Log/Log Details

Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs.  Users are recommended to upgrade to version 2.9.1, which fixes this issue.

Affected products

apache-airflow
  • <2.9.1

Matching in nixpkgs

pkgs.apache-airflow

Programmatically author, schedule and monitor data pipelines

Package maintainers: 3