PT-2024-32458 · Nix+3 · Nix+3

P-E-Meunier · Published 2024-09-26 · Updated 2025-07-14 · CVE-2024-47174

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nix versions 1.11 through 2.18.7 Nix versions 1.11 through 2.24.7

Description The issue is related to the Nix package manager for Linux and other Unix systems. Starting in version 1.11 and prior to versions 2.18.8 and 2.24.8, <nix/fetchurl.nix> did not verify TLS certificates on HTTPS connections. This could lead to connection details such as full URLs or credentials leaking in case of a man-in-the-middle (MITM) attack. A user may be affected by the risk of leaking credentials if they have a netrc file for authentication, or rely on derivations with impureEnvVars set to use credentials from the environment. The commonplace trust-on-first-use (TOFU) technique of updating dependencies by specifying an invalid hash and obtaining it from a remote store was also vulnerable to a MITM injecting arbitrary store objects.

Recommendations For Nix versions 1.11 through 2.18.7, update to version 2.18.8 or later. For Nix versions 1.11 through 2.24.7, update to version 2.24.8 or later. As a temporary workaround, implement (authenticated) fetching with pkgs.fetchurl from Nixpkgs, using impureEnvVars and curlOpts as needed.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2024-47174

GHSA-6FJR-MQ49-MM2C

USN-7633-1

Affected Products

Debian

Linuxmint

Nix

Ubuntu

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47174.json · Exploit
• https://ubuntu.com/security/CVE-2024-47174 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-45593 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47174 · Security Note
• https://ubuntu.com/security/CVE-2024-38531 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47174 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-47174 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7633-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-27297 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-47174 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-47174 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7633-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-47174 · Security Note
• https://github.com/NixOS/nix/security/advisories/GHSA-6fjr-mq49-mm2c · Note
• https://github.com/NixOS/nix/commit/5db358d4d78aea7204a8f22c5bf2a309267ee038 · Note