# CVE-2024-47174: nix: Nix is a package manager for Linux and other Unix systems CVE-2024-47174 is fixed in 3 products on 1 platform, first by nix-bin 2.6.0+dfsg-3ubuntu0.1~esm1, released September 26, 2024. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2024-47174 - Priority: Routine - CVSS: 5.9 (medium) - EPSS: 0.0030 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Sep 26, 2024 ## Description Nix is a package manager for Linux and other Unix systems. Starting in version 1.11 and prior to versions 2.18.8 and 2.24.8, `` did not verify TLS certificates on HTTPS connections. This could lead to connection details such as full URLs or credentials leaking in case of a man-in-the-middle (MITM) attack. `` is also known as the builtin derivation builder `builtin:fetchurl`. It's not to be confused with the evaluation-time function `builtins.fetchurl`, which was not affected by this issue. A user may be affected by the risk of leaking credentials if they have a `netrc` file for authentication, or rely on derivations with `impureEnvVars` set to use credentials from the environment. In addition, the commonplace trust-on-first-use (TOFU) technique of updating dependencies by specifying an invalid hash and obtaining it from a remote store was also vulnerable to a MITM injecting arbitrary store objects. This also applied to the impure derivations experimental feature. Note that this may also happen when using Nixpkgs fetchers to obtain new hashes when not using the fake hash method, although that mechanism is not implemented in Nix itself but rather in Nixpkgs using a fixed-output derivation. The behavior was introduced in version 1.11 to make it consistent with the Nixpkgs `pkgs.fetchurl` and to make `` work in the derivation builder sandbox, which back then did not have access to the CA bundles by default. Nowadays, CA bundles are bind-mounted on Linux. This issue has been fixed in Nix 2.18.8 and 2.24.8. As a workaround, implement (authenticated) fetching with `pkgs.fetchurl` from Nixpkgs, using `impureEnvVars` and `curlOpts` as needed. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | nix Debian 13.5 (trixie) | 2.24.8+dfsg-1 | [DEBIAN-CVE-2024-47174](https://patchblox.com/security/data/fix/linux/debian-cve-2024-47174.md) | Sep 26, 2024 | | Linux | nix Debian 14 | 2.24.8+dfsg-1 | [DEBIAN-CVE-2024-47174](https://patchblox.com/security/data/fix/linux/debian-cve-2024-47174.md) | Sep 26, 2024 | | Linux | nix-bin Ubuntu 22.04.1 LTS (jammy) | 2.6.0+dfsg-3ubuntu0.1~esm1 | [nix-bin 2.6.0+dfsg-3ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-nix-bin-2.6.0-dfsg-3ubuntu0.1-esm1.md) | Sep 26, 2024 | | Linux | nix-bin Ubuntu 24.04.5 LTS (noble) | 2.18.1+dfsg-1ubuntu5+esm2 | [nix-bin 2.18.1+dfsg-1ubuntu5+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-nix-bin-2.18.1-dfsg-1ubuntu5-esm2.md) | Sep 26, 2024 | | Linux | nix-setup-systemd Ubuntu 22.04.1 LTS (jammy) | 2.6.0+dfsg-3ubuntu0.1~esm1 | [nix-setup-systemd 2.6.0+dfsg-3ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-nix-setup-systemd-2.6.0-dfsg-3ubuntu0.1-esm1.md) | Sep 26, 2024 | | Linux | nix-setup-systemd Ubuntu 24.04.5 LTS (noble) | 2.18.1+dfsg-1ubuntu5+esm2 | [nix-setup-systemd 2.18.1+dfsg-1ubuntu5+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-nix-setup-systemd-2.18.1-dfsg-1ubuntu5-esm2.md) | Sep 26, 2024 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.