{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2024-47174 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2024-47174 is a medium-severity vulnerability in NixOS nix, published on 26 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-47174 and fix it if it is affected.\n\nWhat it is: CVE-2024-47174 is a medium-severity vulnerability in NixOS nix, published on 26 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-47174 in the wild and no public exploit code.\n\nAffected product: NixOS nix. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-47174/ (Markdown: https://insights.sbomify.com/CVE-2024-47174/index.md)","id":"CVE-2024-47174","markdown":"https://insights.sbomify.com/CVE-2024-47174/index.md","name":"CVE-2024-47174","record":{"aliases":["DEBIAN-CVE-2024-47174","GHSA-6fjr-mq49-mm2c","UBUNTU-CVE-2024-47174"],"analysis":{"component_type":"developer_tool","fix_type":"upgrade","impacts":["data_read","code_execution"],"network_reachable":"yes","non_default_config":true,"product_category":"Nix package manager","requires_auth":"none","summary":"Man-in-the-middle attackers can leak credentials or inject malicious code via unverified TLS connections in Nix fetchurl operations.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":5.9,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"description":"Nix is a package manager for Linux and other Unix systems. Starting in version 1.11 and prior to versions 2.18.8 and 2.24.8, `\u003cnix/fetchurl.nix\u003e` did not verify TLS certificates on HTTPS connections. This could lead to connection details such as full URLs or credentials leaking in case of a man-in-the-middle (MITM) attack. `\u003cnix/fetchurl.nix\u003e` is also known as the builtin derivation builder `builtin:fetchurl`. It's not to be confused with the evaluation-time function `builtins.fetchurl`, which was not affected by this issue. A user may be affected by the risk of leaking credentials if they have a `netrc` file for authentication, or rely on derivations with `impureEnvVars` set to use credentials from the environment. In addition, the commonplace trust-on-first-use (TOFU) technique of updating dependencies by specifying an invalid hash and obtaining it from a remote  store was also vulnerable to a MITM injecting arbitrary store objects. This also applied to the impure derivations experimental feature. Note that this may also happen when using Nixpkgs fetchers to obtain new hashes when not using the fake hash method, although that mechanism is not implemented in Nix itself but rather in Nixpkgs using a fixed-output derivation. The behavior was introduced in version 1.11 to make it consistent with the Nixpkgs `pkgs.fetchurl` and to make `\u003cnix/fetchurl.nix\u003e` work in the derivation builder sandbox, which back then did not have access to the CA bundles by default. Nowadays, CA bundles are bind-mounted on Linux. This issue has been fixed in Nix 2.18.8 and 2.24.8. As a workaround, implement (authenticated) fetching with `pkgs.fetchurl` from Nixpkgs, using `impureEnvVars` and `curlOpts` as needed.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Credential leak when credentials are used with `\u003cnix/fetchurl.nix\u003e`","id":"CVE-2024-47174","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"information_disclosure","year":"2024"},"n_packages":0,"n_references":4,"next":{"headline":"libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer","id":"CVE-2024-47175"},"packages":[],"prev":{"headline":"Aimeos GraphQL API admin interface denial of service vulnerability in SaaS and marketplace setups","id":"CVE-2024-47173"},"products":["nix"],"published":"2024-09-26","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-09-26","vendors":["NixOS"]},"summary":"Man-in-the-middle attackers can leak credentials or inject malicious code via unverified TLS connections in Nix fetchurl operations.","url":"https://insights.sbomify.com/CVE-2024-47174/"}