p PatchFirst

CVE-2024-36050

CVE-2024-36050

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Nix through 2.22.1 mishandles certain usage of hash caches, which makes it easier for attackers to replace current source code with attacker-controlled source code by luring a maintainer into accepting a malicious pull request.

CVSS 4.3 · Medium · EPSS 0.4%

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • nix Debian:12

    Versions
    • 2.16.1+dfsg-1
    • 2.16.1+dfsg-2
    • 2.16.1+dfsg-3
    • 2.17.1+dfsg-1
    • 2.18.1+dfsg-1
    • 2.22.1+dfsg-1
    • 2.23.3+dfsg-1
    • 2.23.3+dfsg-2
    • 2.24.12+dfsg-1
    • 2.24.8+dfsg-1
    • 2.24.9+dfsg-1
    • 2.24.9+dfsg-2
    • 2.25.4+dfsg-1
    • 2.26.3+dfsg-1
    • 2.32.5+dfsg-1
    • 2.32.5+dfsg-2
    • 2.34.3+dfsg-1
    • 2.34.6+dfsg-1
    • 2.34.8+dfsg-1
    • 2.8.0-1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nix Debian:13

    Versions
    • 2.26.3+dfsg-1
    • 2.32.5+dfsg-1
    • 2.32.5+dfsg-2
    • 2.34.3+dfsg-1
    • 2.34.6+dfsg-1
    • 2.34.8+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nix Debian:14

    Versions
    • 2.26.3+dfsg-1
    • 2.32.5+dfsg-1
    • 2.32.5+dfsg-2
    • 2.34.3+dfsg-1
    • 2.34.6+dfsg-1
    • 2.34.8+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nix Ubuntu:Pro:22.04:LTS

    Versions
    • 2.3.10+dfsg1-1
    • 2.3.10+dfsg1-1build1
    • 2.6.0+dfsg-2
    • 2.6.0+dfsg-3
    • 2.6.0+dfsg-3ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nix Ubuntu:Pro:24.04:LTS

    Versions
    • 2.16.1+dfsg-3ubuntu1
    • 2.18.1+dfsg-1ubuntu1
    • 2.18.1+dfsg-1ubuntu2
    • 2.18.1+dfsg-1ubuntu4
    • 2.18.1+dfsg-1ubuntu5
    • 2.18.1+dfsg-1ubuntu5+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nix Ubuntu:25.10

    Versions
    • 2.24.9+dfsg-2ubuntu2
    • 2.26.3+dfsg-1ubuntu1
    • 2.26.3+dfsg-1ubuntu2
    • 2.26.3+dfsg-1ubuntu4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nix Ubuntu:26.10

    Versions
    • 2.34.3+dfsg-1
    • 2.34.6+dfsg-1
    • 2.34.6+dfsg-1build1
    • 2.34.8+dfsg-1
    • 2.34.8+dfsg-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nix Ubuntu:26.04:LTS

    Versions
    • 2.26.3+dfsg-1ubuntu4
    • 2.26.3+dfsg-1ubuntu5
    • 2.32.5+dfsg-1ubuntu3
    • 2.32.5+dfsg-2ubuntu1
    • 2.34.3+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →