From 18c338a63af271b4c549e0d39d7915bed65ac70c Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Tue, 5 Mar 2024 16:49:50 +0100 Subject: [PATCH] nixVersions.nix*: mark affected versions as vulnerable to CVE-2024-27297 https://www.cve.org/CVERecord?id=CVE-2024-27297 https://github.com/NixOS/nix/security/advisories/GHSA-2ffj-w4mj-pg37 Signed-off-by: Raito Bezarius --- pkgs/tools/package-management/nix/common.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/pkgs/tools/package-management/nix/common.nix b/pkgs/tools/package-management/nix/common.nix index cab48bbaf5b6..77a6bca3e9fb 100644 --- a/pkgs/tools/package-management/nix/common.nix +++ b/pkgs/tools/package-management/nix/common.nix @@ -15,6 +15,14 @@ let atLeast210 = lib.versionAtLeast version "2.10pre"; atLeast213 = lib.versionAtLeast version "2.13pre"; atLeast214 = lib.versionAtLeast version "2.14pre"; + atLeast221 = lib.versionAtLeast version "2.21pre"; + # Major.minor versions unaffected by CVE-2024-27297 + unaffectedByFodSandboxEscape = [ + "2.3" + "2.18" + "2.19" + "2.20" + ]; in { stdenv , autoconf-archive @@ -249,6 +257,7 @@ self = stdenv.mkDerivation { platforms = platforms.unix; outputsToInstall = [ "out" ] ++ optional enableDocumentation "man"; mainProgram = "nix"; + knownVulnerabilities = lib.optional (!builtins.elem (lib.versions.majorMinor version) unaffectedByFodSandboxEscape && !atLeast221) "CVE-2024-27297"; }; }; in self