Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Nix affected by unsafe NAR unpacking
Vulnerability Description
Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root permissions when using the Nix daemon. This issue is fixed in Nix 2.24.6.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Vulnerability Title
Nix 安全漏洞
Vulnerability Description
Nix是Nix开源的一个强大的包管理器。用于制作包。 Nix 2.24.0至2.24.5版本存在安全漏洞，该漏洞源于允许替代者或恶意用户制作NAR,导致有权访问任意文件系统位置。
CVSS Information
N/A
Vulnerability Type
N/A