CVE-2024-47174

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-47174
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-47174.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-47174
Aliases
  • GHSA-6fjr-mq49-mm2c
Related
Published
2024-09-26T18:15:10Z
Modified
2024-10-12T11:31:53.502354Z
Summary
[none]
Details

Nix is a package manager for Linux and other Unix systems. Starting in version 1.11 and prior to versions 2.18.8 and 2.24.8, <nix/fetchurl.nix> did not verify TLS certificates on HTTPS connections. This could lead to connection details such as full URLs or credentials leaking in case of a man-in-the-middle (MITM) attack. <nix/fetchurl.nix> is also known as the builtin derivation builder builtin:fetchurl. It's not to be confused with the evaluation-time function builtins.fetchurl, which was not affected by this issue. A user may be affected by the risk of leaking credentials if they have a netrc file for authentication, or rely on derivations with impureEnvVars set to use credentials from the environment. In addition, the commonplace trust-on-first-use (TOFU) technique of updating dependencies by specifying an invalid hash and obtaining it from a remote store was also vulnerable to a MITM injecting arbitrary store objects. This also applied to the impure derivations experimental feature. Note that this may also happen when using Nixpkgs fetchers to obtain new hashes when not using the fake hash method, although that mechanism is not implemented in Nix itself but rather in Nixpkgs using a fixed-output derivation. The behavior was introduced in version 1.11 to make it consistent with the Nixpkgs pkgs.fetchurl and to make <nix/fetchurl.nix> work in the derivation builder sandbox, which back then did not have access to the CA bundles by default. Nowadays, CA bundles are bind-mounted on Linux. This issue has been fixed in Nix 2.18.8 and 2.24.8. As a workaround, implement (authenticated) fetching with pkgs.fetchurl from Nixpkgs, using impureEnvVars and curlOpts as needed.

References

Affected packages

Debian:11 / nix

Package

Name
nix
Purl
pkg:deb/debian/nix?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.3.7+dfsg1-1
2.3.10+dfsg1-1
2.6.0+dfsg-1
2.6.0+dfsg-2
2.6.0+dfsg-3
2.7.0+dfsg-1
2.7.0+dfsg-2
2.7.0+dfsg-3
2.7.0+dfsg-4
2.7.0+dfsg-5
2.8.0-1
2.8.0-1.1
2.16.1+dfsg-1
2.16.1+dfsg-2
2.16.1+dfsg-3
2.17.1+dfsg-1
2.18.1+dfsg-1
2.22.1+dfsg-1
2.23.3+dfsg-1
2.23.3+dfsg-2
2.24.8+dfsg-1
2.24.9+dfsg-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / nix

Package

Name
nix
Purl
pkg:deb/debian/nix?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.8.0-1.1
2.16.1+dfsg-1
2.16.1+dfsg-2
2.16.1+dfsg-3
2.17.1+dfsg-1
2.18.1+dfsg-1
2.22.1+dfsg-1
2.23.3+dfsg-1
2.23.3+dfsg-2
2.24.8+dfsg-1
2.24.9+dfsg-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / nix

Package

Name
nix
Purl
pkg:deb/debian/nix?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.24.8+dfsg-1

Affected versions

2.*

2.8.0-1.1
2.16.1+dfsg-1
2.16.1+dfsg-2
2.16.1+dfsg-3
2.17.1+dfsg-1
2.18.1+dfsg-1
2.22.1+dfsg-1
2.23.3+dfsg-1
2.23.3+dfsg-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/nixos/nix

Affected ranges

Type
GIT
Repo
https://github.com/nixos/nix
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
062b4a489e30da9c85fa4ff15cfdd2e51cac7b90
Fixed
5db358d4d78aea7204a8f22c5bf2a309267ee038

Affected versions

1.*

1.0
1.1
1.10
1.11
1.11.1
1.2
1.3
1.4
1.5
1.5.1
1.5.2
1.5.3
1.6
1.6.1
1.7
1.8
1.9

2.*

2.0
2.2