Nixpkgs security tracker

Untriaged

Permalink CVE-2024-47516

9.8 CRITICAL

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): NONE
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): HIGH
Integrity impact (I): HIGH
Availability impact (A): HIGH

created 1 year ago

Pagure: argument injection in pagurerepo.log()

A vulnerability was found in Pagure. An argument injection in Git during retrieval of the repository history leads to remote code execution on the Pagure instance.

References

https://access.redhat.com/security/cve/CVE-2024-47516 vdb-entryx_refsource_REDHAT
RHBZ#2315805 x_refsource_REDHATissue-tracking
https://access.redhat.com/security/cve/CVE-2024-47516 vdb-entryx_refsource_REDHAT
RHBZ#2315805 x_refsource_REDHATissue-tracking
https://access.redhat.com/security/cve/CVE-2024-47516 vdb-entryx_refsource_REDHAT
RHBZ#2315805 x_refsource_REDHATissue-tracking
https://access.redhat.com/security/cve/CVE-2024-47516 vdb-entryx_refsource_REDHAT
RHBZ#2315805 x_refsource_REDHATissue-tracking

Affected products

pagure

==5.14.1

Matching in nixpkgs

pkgs.haskellPackages.pagure

Pagure REST client library

nixos-unstable 0.1.2
- nixpkgs-unstable 0.1.2
- nixos-unstable-small 0.1.2

pkgs.haskellPackages.pagure-cli

Pagure client

nixos-unstable 0.2.1
- nixpkgs-unstable 0.2.1
- nixos-unstable-small 0.2.1

Suggestion detail

References

Affected products

Matching in nixpkgs

pkgs.haskellPackages.pagure

pkgs.haskellPackages.pagure-cli