gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

olivetin: add known vulnerabilities

Browse Source
This commit is contained in:
Defelo
2026-03-10 18:31:13 +01:00
parent b210bb1ccc
commit cb203e669d
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/by-name/ol/olivetin/package.nix
+10
View File
@@ -142,6 +142,16 @@ buildGoModule (
license = lib.licenses.agpl3Only;
maintainers = with lib.maintainers; [ defelo ];
mainProgram = "OliveTin";
knownVulnerabilities = [
"CVE-2026-27626: OS Command Injection via password argument type and webhook JSON extraction bypasses shell safety checks"
"CVE-2026-28342: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint"
"CVE-2026-30223: JWT Audience Validation Bypass in Local Key and HMAC Modes"
"CVE-2026-28789: Unauthenticated DoS via concurrent map writes in OAuth2 state handling"
"CVE-2026-30224: Session Fixation - Logout Fails to Invalidate Server-Side Session"
"CVE-2026-28790: Unauthenticated Action Termination via KillAction When Guests Must Login"
"CVE-2026-30233: View permission not being checked when returning dashboards"
"CVE-2026-30225: RestartAction always runs actions as guest"
];
};
}
)