···

       
1
       
1
       
 
       
# Vulnerability Roundup {#chap-vulnerability-roundup}

     

       
2
       
2
       
 
       


     

       
3
       
3
       
-
       
## Issues {#vulnerability-roundup-issues}

     

       
4
       
4
       
-
       


     

       
5
       
5
       
-
       
Vulnerable packages in Nixpkgs are managed using issues.

     

       
6
       
6
       
-
       
Currently opened ones can be found using the following:

     

       
7
       
7
       
-
       


     

       
8
       
8
       
-
       
[github.com/NixOS/nixpkgs/issues?q=is:issue+is:open+"Vulnerability+roundup"](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+%22Vulnerability+roundup%22)

     

       
9
       
9
       
-
       


     

       
10
       
10
       
-
       
Each issue correspond to a vulnerable version of a package; As a consequence:

     

       
11
       
11
       
-
       


     

       
12
       
12
       
-
       
- One issue can contain several CVEs;

     

       
13
       
13
       
-
       
- One CVE can be shared across several issues;

     

       
14
       
14
       
-
       
- A single package can be concerned by several issues.

     

       
15
       
15
       
-
       


     

       
16
       
16
       
-
       


     

       
17
       
17
       
-
       
A "Vulnerability roundup" issue usually respects the following format:

     

       
18
       
18
       
-
       


     

       
19
       
19
       
-
       
```txt

     

       
20
       
20
       
-
       
<link to relevant package search on search.nix.gsc.io>, <link to relevant files in Nixpkgs on GitHub>

     

       
21
       
21
       
-
       


     

       
22
       
22
       
-
       
<list of related CVEs, their CVSS score, and the impacted NixOS version>

     

       
23
       
23
       
-
       


     

       
24
       
24
       
-
       
<list of the scanned Nixpkgs versions>

     

       
3
       
3
       
+
       
This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).

     

       
25
       
4
       
 
       


     

       
26
       
26
       
-
       
<list of relevant contributors>

     

       
27
       
27
       
-
       
```

     

       
5
       
5
       
+
       
## Issues {#vulnerability-roundup-issues}

     

       
28
       
6
       
 
       


     

       
29
       
29
       
-
       
Note that there can be an extra comment containing links to previously reported (and still open) issues for the same package.

     

       
30
       
30
       
-
       


     

       
7
       
7
       
+
       
This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).

     

       
31
       
8
       
 
       


     

       
32
       
9
       
 
       
## Triaging and Fixing {#vulnerability-roundup-triaging-and-fixing}

     

       
33
       
10
       
 
       


     

       
34
       
34
       
-
       
**Note**: An issue can be a "false positive" (i.e. automatically opened, but without the package it refers to being actually vulnerable).

     

       
35
       
35
       
-
       
If you find such a "false positive", comment on the issue an explanation of why it falls into this category, linking as much information as the necessary to help maintainers double check.

     

       
36
       
36
       
-
       


     

       
37
       
37
       
-
       
If you are investigating a "true positive":

     

       
38
       
38
       
-
       


     

       
39
       
39
       
-
       
- Find the earliest patched version or a code patch in the CVE details;

     

       
40
       
40
       
-
       
- Is the issue already patched (version up-to-date or patch applied manually) in Nixpkgs's `master` branch?

     

       
41
       
41
       
-
       
  - **No**:

     

       
42
       
42
       
-
       
    - [Submit a security fix](#submitting-changes-submitting-security-fixes);

     

       
43
       
43
       
-
       
    - Once the fix is merged into `master`, [submit the change to the vulnerable release branch(es)](https://nixos.org/manual/nixpkgs/stable/#submitting-changes-stable-release-branches);

     

       
44
       
44
       
-
       
  - **Yes**: [Backport the change to the vulnerable release branch(es)](https://nixos.org/manual/nixpkgs/stable/#submitting-changes-stable-release-branches).

     

       
45
       
45
       
-
       
- When the patch has made it into all the relevant branches (`master`, and the vulnerable releases), close the relevant issue(s).

     

       
11
       
11
       
+
       
This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).

     

···

       
765
       
765
       
 
       
If a security fix applies to both master and a stable release then, similar to regular changes, they are preferably delivered via master first and cherry-picked to the release branch.

     

       
766
       
766
       
 
       


     

       
767
       
767
       
 
       
Critical security fixes may by-pass the staging branches and be delivered directly to release branches such as `master` and `release-*`.

     

       
768
       
768
       
+
       


     

       
769
       
769
       
+
       
### Vulnerability Roundup {#chap-vulnerability-roundup}

     

       
770
       
770
       
+
       


     

       
771
       
771
       
+
       
#### Issues {#vulnerability-roundup-issues}

     

       
772
       
772
       
+
       


     

       
773
       
773
       
+
       
Vulnerable packages in Nixpkgs are managed using issues.

     

       
774
       
774
       
+
       
Currently opened ones can be found using the following:

     

       
775
       
775
       
+
       


     

       
776
       
776
       
+
       
[github.com/NixOS/nixpkgs/issues?q=is:issue+is:open+"Vulnerability+roundup"](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+%22Vulnerability+roundup%22)

     

       
777
       
777
       
+
       


     

       
778
       
778
       
+
       
Each issue correspond to a vulnerable version of a package; As a consequence:

     

       
779
       
779
       
+
       


     

       
780
       
780
       
+
       
- One issue can contain several CVEs;

     

       
781
       
781
       
+
       
- One CVE can be shared across several issues;

     

       
782
       
782
       
+
       
- A single package can be concerned by several issues.

     

       
783
       
783
       
+
       


     

       
784
       
784
       
+
       


     

       
785
       
785
       
+
       
A "Vulnerability roundup" issue usually respects the following format:

     

       
786
       
786
       
+
       


     

       
787
       
787
       
+
       
```txt

     

       
788
       
788
       
+
       
<link to relevant package search on search.nix.gsc.io>, <link to relevant files in Nixpkgs on GitHub>

     

       
789
       
789
       
+
       


     

       
790
       
790
       
+
       
<list of related CVEs, their CVSS score, and the impacted NixOS version>

     

       
791
       
791
       
+
       


     

       
792
       
792
       
+
       
<list of the scanned Nixpkgs versions>

     

       
793
       
793
       
+
       


     

       
794
       
794
       
+
       
<list of relevant contributors>

     

       
795
       
795
       
+
       
```

     

       
796
       
796
       
+
       


     

       
797
       
797
       
+
       
Note that there can be an extra comment containing links to previously reported (and still open) issues for the same package.

     

       
798
       
798
       
+
       


     

       
799
       
799
       
+
       


     

       
800
       
800
       
+
       
#### Triaging and Fixing {#vulnerability-roundup-triaging-and-fixing}

     

       
801
       
801
       
+
       


     

       
802
       
802
       
+
       
**Note**: An issue can be a "false positive" (i.e. automatically opened, but without the package it refers to being actually vulnerable).

     

       
803
       
803
       
+
       
If you find such a "false positive", comment on the issue an explanation of why it falls into this category, linking as much information as the necessary to help maintainers double check.

     

       
804
       
804
       
+
       


     

       
805
       
805
       
+
       
If you are investigating a "true positive":

     

       
806
       
806
       
+
       


     

       
807
       
807
       
+
       
- Find the earliest patched version or a code patch in the CVE details;

     

       
808
       
808
       
+
       
- Is the issue already patched (version up-to-date or patch applied manually) in Nixpkgs's `master` branch?

     

       
809
       
809
       
+
       
  - **No**:

     

       
810
       
810
       
+
       
    - [Submit a security fix](#submitting-changes-submitting-security-fixes);

     

       
811
       
811
       
+
       
    - Once the fix is merged into `master`, [submit the change to the vulnerable release branch(es)](https://nixos.org/manual/nixpkgs/stable/#submitting-changes-stable-release-branches);

     

       
812
       
812
       
+
       
  - **Yes**: [Backport the change to the vulnerable release branch(es)](https://nixos.org/manual/nixpkgs/stable/#submitting-changes-stable-release-branches).

     

       
813
       
813
       
+
       
- When the patch has made it into all the relevant branches (`master`, and the vulnerable releases), close the relevant issue(s).