From d22ebf086f1b59784796d2d8ab08786b6bee9b1f Mon Sep 17 00:00:00 2001 From: Defelo Date: Wed, 11 Mar 2026 14:04:44 +0100 Subject: [PATCH 1/2] olivetin: sort `knownVulnerabilities` --- pkgs/by-name/ol/olivetin/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ol/olivetin/package.nix b/pkgs/by-name/ol/olivetin/package.nix index 6adec86ce479..6da706e5c1a9 100644 --- a/pkgs/by-name/ol/olivetin/package.nix +++ b/pkgs/by-name/ol/olivetin/package.nix @@ -145,12 +145,12 @@ buildGoModule ( knownVulnerabilities = [ "CVE-2026-27626: OS Command Injection via password argument type and webhook JSON extraction bypasses shell safety checks" "CVE-2026-28342: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint" - "CVE-2026-30223: JWT Audience Validation Bypass in Local Key and HMAC Modes" "CVE-2026-28789: Unauthenticated DoS via concurrent map writes in OAuth2 state handling" - "CVE-2026-30224: Session Fixation - Logout Fails to Invalidate Server-Side Session" "CVE-2026-28790: Unauthenticated Action Termination via KillAction When Guests Must Login" - "CVE-2026-30233: View permission not being checked when returning dashboards" + "CVE-2026-30223: JWT Audience Validation Bypass in Local Key and HMAC Modes" + "CVE-2026-30224: Session Fixation - Logout Fails to Invalidate Server-Side Session" "CVE-2026-30225: RestartAction always runs actions as guest" + "CVE-2026-30233: View permission not being checked when returning dashboards" ]; }; } From 0cca63b7dafa7f783685d575947bda3c09701926 Mon Sep 17 00:00:00 2001 From: Defelo Date: Wed, 11 Mar 2026 14:05:29 +0100 Subject: [PATCH 2/2] olivetin: add CVE-2026-31817 to `knownVulnerabilities` --- pkgs/by-name/ol/olivetin/package.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/by-name/ol/olivetin/package.nix b/pkgs/by-name/ol/olivetin/package.nix index 6da706e5c1a9..90b5bb036013 100644 --- a/pkgs/by-name/ol/olivetin/package.nix +++ b/pkgs/by-name/ol/olivetin/package.nix @@ -151,6 +151,7 @@ buildGoModule ( "CVE-2026-30224: Session Fixation - Logout Fails to Invalidate Server-Side Session" "CVE-2026-30225: RestartAction always runs actions as guest" "CVE-2026-30233: View permission not being checked when returning dashboards" + "CVE-2026-31817: Unsafe parsing of UniqueTrackingId can be used to write files" ]; }; }