5 results · Clear filters · Feed
-
Medium 4.0
The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the install…
-
Medium 5.3
An issue was discovered in Nix before 2.34.7. Writing to arbitrary files can occur via "nix-prefetch-url --unpack" or "…
-
Medium 5.9
Credential leak when credentials are used with `<nix/fetchurl.nix>`
Nix is a package manager for Linux and other Unix systems. Starting in version 1.11 and prior to versions 2.18.8 and 2.24.8, `<nix/fetchurl.nix>` did not verify TLS certificates on HTTPS connections. This could lead to connection details such as full URLs or …
-
Medium 4.3
Nix through 2.22.1 mishandles certain usage of hash caches, which makes it easier for attackers to replace current sour…
-
Medium 6.3
Nix Corruption of fixed-output derivations
Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstr…