Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Dismissed
(no matching packages found)
Permalink CVE-2025-12799
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
created 1 week, 6 days ago Activity log
  • Created & dismissed (no matching packages found) suggestion
Jastow: jastow cross-site scripting attack due to unsanitized uri

A flaw was found in Jastow. Jastow is vulnerable to Cross-Site Scripting (XSS) attack. If using a set of combined configuration to allow unescaped characters in URL with embedded Undertow and Jastow, a server might be vulnerable to improper input handling.

References

Affected products

eap8
  • *
jastow
eap8-ecj
  • *
eap8-vdx
  • *
eap8-gson
  • *
eap8-hppc
  • *
eap8-jaxb
  • *
eap8-angus
  • *
eap8-jansi
  • *
eap8-log4j
  • *
eap8-netty
  • *
eap8-slf4j
  • *
eap8-wss4j
  • *
eap8-agroal
  • *
eap8-antlr4
  • *
eap8-jandex
  • *
eap8-jasypt
  • *
eap8-jberet
  • *
eap8-jose4j
  • *
eap8-neethi
  • *
eap8-wsdl4j
  • *
eap8-yasson
  • *
eap8-fge-btf
  • *
eap8-hornetq
  • *
eap8-jctools
  • *
eap8-jgroups
  • *
eap8-parsson
  • *
eap8-stax-ex
  • *
eap8-wildfly
  • *
eap8-atinject
  • *
eap8-caffeine
  • *
eap8-javaewah
  • *
eap8-jsf-impl
  • *
eap8-narayana
  • *
eap8-opensaml
  • *
eap8-resteasy
  • *
eap8-undertow
  • *
eap8-velocity
  • *
eap8-asyncutil
  • *
eap8-expressly
  • *
eap8-hibernate
  • *
eap8-jboss-dmr
  • *
eap8-jboss-msc
  • *
eap8-jboss-vfs
  • *
eap8-joda-time
  • *
eap8-saaj-impl
  • *
eap8-snakeyaml
  • *
eap8-stax2-api
  • *
eap8-weld-core
  • *
eap8-apache-cxf
  • *
eap8-byte-buddy
  • *
eap8-gnu-getopt
  • *
eap8-h2database
  • *
eap8-infinispan
  • *
eap8-jaxbintros
  • *
eap8-jboss-aesh
  • *
eap8-json-patch
  • *
eap8-jsonb-spec
  • *
eap8-staxmapper
  • *
eap8-apache-sshd
  • *
eap8-cryptacular
  • *
eap8-elytron-web
  • *
eap8-eventstream
  • *
eap8-fastinfoset
  • *
eap8-hal-console
  • *
eap8-ironjacamar
  • *
eap8-jboss-stdio
  • *
eap8-jbossws-api
  • *
eap8-jbossws-cxf
  • *
eap8-jbossws-spi
  • *
eap8-jgroups-aws
  • *
eap8-lucene-solr
  • *
eap8-mod_cluster
  • *
eap8-protoparser
  • *
eap8-protostream
  • *
eap8-aws-java-sdk
  • *
eap8-bouncycastle
  • *
eap8-eclipse-jgit
  • *
eap8-jackson-core
  • *
eap8-jakarta-json
  • *
eap8-jakarta-mail
  • *
eap8-pem-keystore
  • *
eap8-plexus-utils
  • *
eap8-resilience4j
  • *
eap8-xml-security
  • *
eap8-aesh-readline
  • *
eap8-apache-mime4j
  • *
eap8-azure-storage
  • *
eap8-elasticsearch
  • *
eap8-jboss-logging
  • *
eap8-jboss-modules
  • *
eap8-jboss-threads
  • *
eap8-jgroups-azure
  • *
eap8-objectweb-asm
  • *
eap8-woodstox-core
  • *
eap8-artemis-native
  • *
eap8-fge-msg-simple
  • *
eap8-java-classmate
  • *
eap8-jboss-metadata
  • *
eap8-jboss-remoting
  • *
eap8-jboss-weld-api
  • *
eap8-jbossws-common
  • *
eap8-wildfly-common
  • *
eap8-aesh-extensions
  • *
eap8-guava-libraries
  • *
eap8-jakarta-ejb-api
  • *
eap8-jakarta-jms-api
  • *
eap8-javaee-jpa-spec
  • *
eap8-jboss-xnio-base
  • *
eap8-nimbus-jose-jwt
  • *
eap8-resteasy-spring
  • *
eap8-undertow-jastow
  • *
eap8-wildfly-elytron
  • *
eap8-wildfly-openssl
  • *
eap8-activemq-artemis
  • *
eap8-angus-activation
  • *
eap8-hibernate-search
  • *
eap8-jackson-databind
  • *
eap8-jakarta-json-api
  • *
eap8-jboss-ejb-client
  • *
eap8-jboss-genericjms
  • *
eap8-jboss-invocation
  • *
eap8-jboss-logmanager
  • *
eap8-jcip-annotations
  • *
eap8-reactive-streams
  • *
eap8-reactivex-rxjava
  • *
eap8-wildfly-javadocs
  • *
eap8-apache-commons-io
  • *
eap8-jackson-coreutils
  • *
eap8-jakarta-batch-api
  • *
eap8-jakarta-websocket
  • *
eap8-jakarta-ws-rs-api
  • *
eap8-jboss-cert-helper
  • *
eap8-jboss-iiop-client
  • *
eap8-jboss-marshalling
  • *
eap8-jboss-openjdk-orb
  • *
eap8-jul-to-slf4j-stub
  • *
eap8-reactivex-rxjava2
  • *
eap8-wildfly-discovery
  • *
eap8-apache-commons-cli
  • *
eap8-jakarta-activation
  • *
eap8-javapackages-tools
  • *
eap8-jboss-common-beans
  • *
eap8-jboss-ejb3-ext-api
  • *
eap8-jboss-remoting-jmx
  • *
eap8-jgroups-kubernetes
  • *
eap8-sun-istack-commons
  • *
eap8-wildfly-clustering
  • *
eap8-wildfly-elytron-ee
  • *
eap8-apache-commons-lang
  • *
eap8-guava-failureaccess
  • *
eap8-hibernate-validator
  • *
eap8-httpcomponents-core
  • *
eap8-jackson-annotations
  • *
eap8-jakarta-servlet-api
  • *
eap8-resteasy-extensions
  • *
eap8-wildfly-http-client
  • *
eap8-apache-commons-codec
  • *
eap8-apache-cxf-xjc-utils
  • *
eap8-insights-java-client
  • *
eap8-jackson-modules-base
  • *
eap8-jakarta-resource-api
  • *
eap8-jakarta-xml-bind-api
  • *
eap8-jbossws-common-tools
  • *
eap8-netty-xnio-transport
  • *
eap8-ws-commons-XmlSchema
  • *
eap8-xml-commons-resolver
  • *
io.undertow.jastow-jastow
eap8-httpcomponents-client
  • *
eap8-jackson-modules-java8
  • *
eap8-jboss-classfilewriter
  • *
eap8-jboss-el-api_5.0_spec
  • *
eap8-jboss-transaction-spi
  • *
eap8-wildfly-client-config
  • *
eap8-wildfly-naming-client
  • *
eap8-jakarta-annotation-api
  • *
eap8-jakarta-validation-api
  • *
eap8-slf4j-jboss-logmanager
  • *
eap8-activemq-artemis-native
  • *
eap8-eap-product-conf-parent
  • *
eap8-jackson-jaxrs-providers
  • *
eap8-jakarta-interceptor-api
  • *
eap8-jakarta-servlet-jsp-api
  • *
eap8-jakarta-transaction-api
  • *
eap8-javaee-security-soteria
  • *
eap8-jboss-saaj-api_3.0_spec
  • *
eap8-log4j2-jboss-logmanager
  • *
eap8-shibboleth-java-support
  • *
eap8-apache-commons-beanutils
  • *
eap8-installation-manager-api
  • *
eap8-jackson-dataformats-text
  • *
eap8-jakarta-authorization-api
  • *
eap8-apache-commons-collections
  • *
eap8-httpcomponents-asyncclient
  • *
eap8-jakarta-authentication-api
  • *
eap8-wildfly-transaction-client
  • *
eap8-artemis-wildfly-integration
  • *
eap8-wildfly-openssl-el10-x86_64
  • *
eap8-jakarta-servlet-jsp-jstl-api
  • *
eap8-netty-transport-native-epoll
  • *
eap8-commons-logging-jboss-logging
  • *
eap8-hibernate-commons-annotations
  • *
eap8-jakarta-enterprise-concurrent
  • *
eap8-jakarta-enterprise-lang-model
  • *
eap8-jbossws-jaxws-undertow-httpspi
  • *
eap8-jakarta-security-enterprise-api
  • *
eap8-jakarta-enterprise-concurrent-api
  • *
eap8-jboss-jakarta-xml-ws-api_4.0_spec
  • *
jboss-eap-7/eap74-els-openjdk8-openshift-rhel8
jboss-eap-7/eap74-els-openjdk17-openshift-rhel8
eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8
eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8
eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8