CVE-2021-45707
An issue was discovered in the nix crate 0.16.0 and later before 0.20. ...
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Azure Linux. Daha düşük diyenler: GHSA (orta), Ubuntu (orta).
Açıklama
An issue was discovered in the nix crate 0.16.0 and later before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2 for Rust. unistd::getgrouplist has an out-of-bounds write if a user is in more than 16 /etc/groups groups.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| Azure Linux 3.0 | rpm-ostree | 0:2024.4-1.azl3 |
| cargo::GitHub Security Advisory Rust | nix | 0.20.2, 0.21.2, 0.22.2 |
| chainguard | nsexec, toda | 0.1.7-r2 ve 1 tane daha |
| debian 11 | rust-nix | düzeltme belirtilmemiş |
| debian 12 | rust-nix | 0.23.0-1 |
| debian 13 | rust-nix | 0.23.0-1 |
| debian 14 | rust-nix | 0.23.0-1 |
| echo | rust-nix | 0.23.0-1 |
| ubuntu 20.04-ESM | rust-nix | düzeltme belirtilmemiş |
| ubuntu 22.04 | rust-nix | düzeltme belirtilmemiş |
| ubuntu 24.04 | rust-nix | düzeltme belirtilmemiş |
| ubuntu 26.04 | rust-nix | düzeltme belirtilmemiş |
13 kaynaktaki 14 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| Azure Linux 3.0 | rpm-ostree | 0:2024.4-1.azl3 |
| cargo::GitHub Security Advisory Rust | nix | 0.20.2, 0.21.2, 0.22.2 |
| chainguard | nsexec | 0.1.7-r2 |
| chainguard | toda | 0.3.0-r0 |
| debian 11 | rust-nix | düzeltme belirtilmemiş |
| debian 12 | rust-nix | 0.23.0-1 |
| debian 13 | rust-nix | 0.23.0-1 |
| debian 14 | rust-nix | 0.23.0-1 |
| echo | rust-nix | 0.23.0-1 |
| ubuntu 20.04-ESM | rust-nix | düzeltme belirtilmemiş |
| ubuntu 22.04 | rust-nix | düzeltme belirtilmemiş |
| ubuntu 24.04 | rust-nix | düzeltme belirtilmemiş |
| ubuntu 26.04 | rust-nix | düzeltme belirtilmemiş |
| ubuntu 26.10 | rust-nix | düzeltme belirtilmemiş |
Referanslar
- https://github.com/advisories/GHSA-wgrg-5h56-jg27
- https://github.com/nix-rust/nix
- https://github.com/nix-rust/nix/issues/1541
- https://nvd.nist.gov/vuln/detail/CVE-2021-45707
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/nix/RUSTSEC-2021-0119.md
- https://rustsec.org/advisories/RUSTSEC-2021-0119.html
- https://www.cve.org/CVERecord?id=CVE-2021-45707