PT-2024-26864 · Nix+1 · Nix+1

Tomberek · Published 2024-05-18 · Updated 2025-06-27 · CVE-2024-36050

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nix versions prior to 2.22.1

Description The issue makes it easier for attackers to replace current source code with attacker-controlled source code by luring a maintainer into accepting a malicious pull request. This is due to the mishandling of certain usage of hash caches.

Recommendations For versions prior to 2.22.1, update to a version that includes the fix for this issue to prevent attackers from replacing source code. As a temporary workaround, consider implementing additional validation and verification steps for pull requests to minimize the risk of accepting malicious changes. Restrict access to hash cache functionality to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2024-36050

Affected Products

Debian

Nix

References · 15

• https://security-tracker.debian.org/tracker/CVE-2024-36050 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-36050 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-36050 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-36050 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36050 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-36050 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36050 · Security Note
• https://github.com/NixOS/nix/issues/969 · Note
• https://github.com/NixOS/ofborg/issues/68#issuecomment-2082789441 · Note
• https://t.me/cvenotify/80713 · Telegram Post
• https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017/26 · Note
• https://twitter.com/VulmonFeeds/status/1791989866332303484 · Twitter Post
• https://discourse.nixos.org/t/nixpkgs-supply-chain-security-project/34345 · Note
• https://t.me/cvenotify/126861 · Telegram Post
• https://t.me/cvenotify/80366 · Telegram Post