Vulnerability Roundup


Vulnerable packages in Nixpkgs are managed using issues. Currently opened ones can be found using the following:"Vulnerability+roundup"

Each issue correspond to a vulnerable version of a package; As a consequence:

  • One issue can contain several CVEs;
  • One CVE can be shared across several issues;
  • A single package can be concerned by several issues.

A "Vulnerability roundup" issue usually respects the following format:

<link to relevant package search on>, <link to relevant files in Nixpkgs on GitHub>

<list of related CVEs, their CVSS score, and the impacted NixOS version>

<list of the scanned Nixpkgs versions>

<list of relevant contributors>

Note that there can be an extra comment containing links to previously reported (and still open) issues for the same package.

Triaging and Fixing

Note: An issue can be a "false positive" (i.e. automatically opened, but without the package it refers to being actually vulnerable). If you find such a "false positive", comment on the issue an explanation of why it falls into this category, linking as much information as the necessary to help maintainers double check.

If you are investigating a "true positive":