{
  "cveId": "CVE-2024-47174",
  "url": "https://patchblox.com/security/cve/CVE-2024-47174",
  "summary": "CVE-2024-47174 is fixed in 3 products on 1 platform, first by nix-bin 2.6.0\u002Bdfsg-3ubuntu0.1~esm1, released September 26, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "nix: Nix is a package manager for Linux and other Unix systems",
  "description": "Nix is a package manager for Linux and other Unix systems. Starting in version 1.11 and prior to versions 2.18.8 and 2.24.8, \u0060\u003Cnix/fetchurl.nix\u003E\u0060 did not verify TLS certificates on HTTPS connections. This could lead to connection details such as full URLs or credentials leaking in case of a man-in-the-middle (MITM) attack. \u0060\u003Cnix/fetchurl.nix\u003E\u0060 is also known as the builtin derivation builder \u0060builtin:fetchurl\u0060. It\u0027s not to be confused with the evaluation-time function \u0060builtins.fetchurl\u0060, which was not affected by this issue. A user may be affected by the risk of leaking credentials if they have a \u0060netrc\u0060 file for authentication, or rely on derivations with \u0060impureEnvVars\u0060 set to use credentials from the environment. In addition, the commonplace trust-on-first-use (TOFU) technique of updating dependencies by specifying an invalid hash and obtaining it from a remote  store was also vulnerable to a MITM injecting arbitrary store objects. This also applied to the impure derivations experimental feature. Note that this may also happen when using Nixpkgs fetchers to obtain new hashes when not using the fake hash method, although that mechanism is not implemented in Nix itself but rather in Nixpkgs using a fixed-output derivation. The behavior was introduced in version 1.11 to make it consistent with the Nixpkgs \u0060pkgs.fetchurl\u0060 and to make \u0060\u003Cnix/fetchurl.nix\u003E\u0060 work in the derivation builder sandbox, which back then did not have access to the CA bundles by default. Nowadays, CA bundles are bind-mounted on Linux. This issue has been fixed in Nix 2.18.8 and 2.24.8. As a workaround, implement (authenticated) fetching with \u0060pkgs.fetchurl\u0060 from Nixpkgs, using \u0060impureEnvVars\u0060 and \u0060curlOpts\u0060 as needed.",
  "published": "2024-09-26T11:15:00Z",
  "severity": "medium",
  "cvss": 5.9,
  "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss": 0.00297,
  "epssPercentile": 0.22523,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "nix",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2.24.8\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2024-47174",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-47174",
      "released": "2024-09-26T18:15:10Z"
    },
    {
      "platform": "linux",
      "product": "nix",
      "release": "Debian 14",
      "fixedVersion": "2.24.8\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2024-47174",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-47174",
      "released": "2024-09-26T18:15:10Z"
    },
    {
      "platform": "linux",
      "product": "nix-bin",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2.6.0\u002Bdfsg-3ubuntu0.1~esm1",
      "fix": "nix-bin 2.6.0\u002Bdfsg-3ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-nix-bin-2.6.0-dfsg-3ubuntu0.1-esm1",
      "released": "2024-09-26T11:15:00Z"
    },
    {
      "platform": "linux",
      "product": "nix-bin",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "2.18.1\u002Bdfsg-1ubuntu5\u002Besm2",
      "fix": "nix-bin 2.18.1\u002Bdfsg-1ubuntu5\u002Besm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-nix-bin-2.18.1-dfsg-1ubuntu5-esm2",
      "released": "2024-09-26T11:15:00Z"
    },
    {
      "platform": "linux",
      "product": "nix-setup-systemd",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2.6.0\u002Bdfsg-3ubuntu0.1~esm1",
      "fix": "nix-setup-systemd 2.6.0\u002Bdfsg-3ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-nix-setup-systemd-2.6.0-dfsg-3ubuntu0.1-esm1",
      "released": "2024-09-26T11:15:00Z"
    },
    {
      "platform": "linux",
      "product": "nix-setup-systemd",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "2.18.1\u002Bdfsg-1ubuntu5\u002Besm2",
      "fix": "nix-setup-systemd 2.18.1\u002Bdfsg-1ubuntu5\u002Besm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-nix-setup-systemd-2.18.1-dfsg-1ubuntu5-esm2",
      "released": "2024-09-26T11:15:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}