nix-0.12.0.crate: 1 vulnerabilities (highest severity is: 9.8)

[mend-for-github-com]

Vulnerable Library - nix-0.12.0.crate

Rust friendly bindings to *nix APIs

Library home page: https://crates.io/api/v1/crates/nix/0.12.0/download

Path to dependency file: /Cargo.toml

Path to vulnerable library: /Cargo.toml

Found in HEAD commit: 2cc6ea9aaa5f45417bb74d75020bc47a9a33d962

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (nix version)	Remediation Possible**
CVE-2021-45707	Critical	9.8	nix-0.12.0.crate	Direct	nix - 0.20.2,0.21.2,0.22.2,0.23.0	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-45707

Vulnerable Library - nix-0.12.0.crate

Rust friendly bindings to *nix APIs

Library home page: https://crates.io/api/v1/crates/nix/0.12.0/download

Path to dependency file: /Cargo.toml

Path to vulnerable library: /Cargo.toml

Dependency Hierarchy:

• ❌ nix-0.12.0.crate (Vulnerable Library)

Found in HEAD commit: 2cc6ea9aaa5f45417bb74d75020bc47a9a33d962

Found in base branch: develop

Vulnerability Details

An issue was discovered in the nix crate 0.16.0 and later before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2 for Rust. unistd::getgrouplist has an out-of-bounds write if a user is in more than 16 /etc/groups groups.

Publish Date: 2021-12-26

URL: CVE-2021-45707

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45708

Release Date: 2021-12-27

Fix Resolution: nix - 0.20.2,0.21.2,0.22.2,0.23.0