CVE-2021-45707GHSA-WGRG-5H56-JG27GHSA-76W9-P8MG-J927RUSTSEC-2021-0119
An issue was discovered in the nix crate 0.16.0 and later before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2 for Rust.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.20.2, 0.21.2, 0.22.2, 0.23.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
An issue was discovered in the nix crate 0.16.0 and later before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2 for Rust. unistd::getgrouplist has an out-of-bounds write if a user is in more than 16 /etc/groups groups.
Timeline
- CVE published
- Record last updated
Affected versions
- n/a n/a
Version range not reported
- nixcrates.io
From 0.16.0 · fixed in 0.20.2
- nixcrates.io
From 0.21.0 · fixed in 0.21.2
- nixcrates.io
From 0.22.0 · fixed in 0.22.2
- nixcrates.io
From 0.16.0 · fixed in 0.20.2; From 0.21.0-0 · fixed in 0.21.2; From 0.22.0-0 · fixed in 0.22.2; From 0.23.0-0 · fixed in 0.23.0