CVE-2021-45707
An issue was discovered in the nix crate 0.16.0 and later before 0.20. ...
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Azure Linux. Niedriger laut GHSA (mittel), Ubuntu (mittel).
Beschreibung
An issue was discovered in the nix crate 0.16.0 and later before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2 for Rust. unistd::getgrouplist has an out-of-bounds write if a user is in more than 16 /etc/groups groups.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| Azure Linux 3.0 | rpm-ostree | 0:2024.4-1.azl3 |
| cargo::GitHub Security Advisory Rust | nix | 0.20.2, 0.21.2, 0.22.2 |
| chainguard | nsexec, toda | 0.1.7-r2 und 1 weitere |
| debian 11 | rust-nix | kein Fix angegeben |
| debian 12 | rust-nix | 0.23.0-1 |
| debian 13 | rust-nix | 0.23.0-1 |
| debian 14 | rust-nix | 0.23.0-1 |
| echo | rust-nix | 0.23.0-1 |
| ubuntu 20.04-ESM | rust-nix | kein Fix angegeben |
| ubuntu 22.04 | rust-nix | kein Fix angegeben |
| ubuntu 24.04 | rust-nix | kein Fix angegeben |
| ubuntu 26.04 | rust-nix | kein Fix angegeben |
Alle 14 Einträge aus 13 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| Azure Linux 3.0 | rpm-ostree | 0:2024.4-1.azl3 |
| cargo::GitHub Security Advisory Rust | nix | 0.20.2, 0.21.2, 0.22.2 |
| chainguard | nsexec | 0.1.7-r2 |
| chainguard | toda | 0.3.0-r0 |
| debian 11 | rust-nix | kein Fix angegeben |
| debian 12 | rust-nix | 0.23.0-1 |
| debian 13 | rust-nix | 0.23.0-1 |
| debian 14 | rust-nix | 0.23.0-1 |
| echo | rust-nix | 0.23.0-1 |
| ubuntu 20.04-ESM | rust-nix | kein Fix angegeben |
| ubuntu 22.04 | rust-nix | kein Fix angegeben |
| ubuntu 24.04 | rust-nix | kein Fix angegeben |
| ubuntu 26.04 | rust-nix | kein Fix angegeben |
| ubuntu 26.10 | rust-nix | kein Fix angegeben |
Referenzen
- https://github.com/advisories/GHSA-wgrg-5h56-jg27
- https://github.com/nix-rust/nix
- https://github.com/nix-rust/nix/issues/1541
- https://nvd.nist.gov/vuln/detail/CVE-2021-45707
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/nix/RUSTSEC-2021-0119.md
- https://rustsec.org/advisories/RUSTSEC-2021-0119.html
- https://www.cve.org/CVERecord?id=CVE-2021-45707