Nixpkgs security tracker
7.3 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Changed (C)
- Confidentiality (C): Low (L)
- Integrity (I): High (H)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Changed (C)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to --deny-read, --deny-write, --deny-run, or --deny-ffi. On macOS, that comparison was done at the raw-byte level while the APFS filesystem treats different Unicode spellings of the same name as the same file. That means a program could reach a denied path by spelling it differently than the deny rule. This vulnerability is fixed in 2.7.14.
References
-
https://github.com/denoland/deno/security/advisories/GHSA-8xpq-cjcf-3wh9 x_refsource_CONFIRM
Affected products
- ==< 2.7.14
Matching in nixpkgs
pkgs.deno
Secure runtime for JavaScript and TypeScript
pkgs.speech-denoiser
Speech denoise lv2 plugin based on RNNoise library
-
nixos-unstable -
- nixos-unstable-small 0-unstable-2018-10-08
-
nixos-26.05 -
- nixos-26.05-small 0-unstable-2018-10-08
pkgs.openimagedenoise
High-Performance Denoising Library for Ray Tracing
pkgs.terraform-providers.deno
None
pkgs.python312Packages.denonavr
None
pkgs.python313Packages.denonavr
Automation Library for Denon AVR receivers
pkgs.python314Packages.denonavr
Automation Library for Denon AVR receivers
pkgs.python313Packages.denon-rs232
Async library to control Denon receivers over RS232
pkgs.python314Packages.denon-rs232
Async library to control Denon receivers over RS232
pkgs.haskellPackages.pandoc-sidenote
Convert Pandoc Markdown-style footnotes into sidenotes
pkgs.terraform-providers.denoland_deno
None
pkgs.gnomeExtensions.denon-avr-controler
Denon AVR controler
pkgs.python312Packages.bnunicodenormalizer
None
pkgs.python313Packages.bnunicodenormalizer
Bangla Unicode Normalization Toolkit
pkgs.python314Packages.bnunicodenormalizer
Bangla Unicode Normalization Toolkit
pkgs.vscode-extensions.denoland.vscode-deno
Language server client for Deno
pkgs.home-assistant-component-tests.denonavr
None
pkgs.gnomeExtensions.marantz-and-denon-avr-controller
Control your Marantz or Denon AVR from GNOME Shell.