← All distributions
Updated 10:00
Determinate Secure Packages distribution
secure-packages-rollingSupportedFIPS supported
Built on Nixpkgs master. Available for use in production environments and covered by our standard service-level agreement (SLA).
Fixed in the last 30 days
234
Fixed in the last 7 days
119
In progress
370
Use this distribution
Customers onlyDeterminate Secure Packages is available through FlakeHub to organizations with access. Not a customer yet? Get in touch to gain access or schedule a demo.
Standardflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling/0";
}FIPS variant
FIPS variantflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling-fips/0";
}The FIPS variant is the package set with Federal Information Processing Standards (FIPS) mode enabled. Using the FIPS variant has the details.
604 CVEs tracked
| CVE | Status | Severity | Summary | Fixed |
|---|---|---|---|---|
| Fixed | High | PYSEC-2026-3984: Regex DoS in GitPython <3.1.60 parsing malformed commit author with unterminated bracket | Oct 12, 2026 | |
| Fixed | High | PYSEC-2026-3982: GitPython <3.1.60 gitdir spoofing enables malicious pre-commit hook execution on index.commit() | Oct 12, 2026 | |
| Fixed | Medium | PYSEC-2026-3927: Apache Thrift Python: host mismatch certificate validation vulnerability before 0.24.0 | Oct 12, 2026 | |
| Fixed | High | PYSEC-2026-3926: Infinite loop vulnerability in Apache Thrift Python, Go, PHP, Java bindings before 0.24.0 | Oct 12, 2026 | |
| Fixed | High | PYSEC-2026-3925: Data amplification vulnerability in Apache Thrift Python bindings before 0.24.0 | Oct 12, 2026 | |
| Fixed | Medium | PYSEC-2026-3837: GitPython TagReference.create positional reference bypasses unsafe-option guard; arbitrary file read | Oct 12, 2026 | |
| Fixed | High | PYSEC-2026-3788: GitPython <3.1.59 unsafe_git_revision_options omits --contents/-S, enabling arbitrary file read via Repo.blame | Oct 12, 2026 | |
| Fixed | High | PYSEC-2026-3787: GitPython <3.1.59 allows --separate-git-dir abuse, arbitrary directory creation and hook execution | Oct 12, 2026 | |
| Fixed | Critical | PYSEC-2026-3786: GitPython <3.1.59 config write corrupts multi-line values, enabling directive injection and RCE via hooks | Oct 12, 2026 | |
| Fixed | High | PYSEC-2026-3785: GitPython <3.1.59 exposes sensitive files via .gitmodules [include] when accessing repo.submodules | Oct 12, 2026 | |
| Fixed | Critical | PYSEC-2026-132: SimpleEval pre-1.0.5 allows dangerous module access via object attributes and callbacks | Oct 12, 2026 | |
| Fixed | Medium | GHSA-hwrj-9rr4-24xh: Apache Thrift Python bindings: improper TLS certificate hostname validation vulnerability before 0.24.0 | Oct 12, 2026 | |
| Fixed | High | GHSA-g5vv-9gxw-82hx: GitPython catastrophic backtracking ReDoS in Actor.name_email_regex on malformed author header | Oct 12, 2026 | |
| Fixed | High | GHSA-8wv5-x4w7-5gww: Infinite loop vulnerability in Apache Thrift Python/Go/PHP/Java bindings prior to 0.24.0 | Oct 12, 2026 | |
| Fixed | High | GHSA-8mcc-hrx5-hvxc: GitPython clone options denylist omits --separate-git-dir, enabling .git escape to arbitrary path | Oct 12, 2026 | |
| Fixed | High | GHSA-7833-fr7j-v32q: GitPython repo.submodules reads .gitmodules includes, leaking arbitrary local file first line via exception | Oct 12, 2026 | |
| Fixed | High | GHSA-6pjx-3pjc-mrj8: Data amplification vulnerability in Apache Thrift Python bindings before 0.24.0 (compressed data) | Oct 12, 2026 | |
| Fixed | Medium | GHSA-5xxx-qhh7-9287: GitPython Repo.blame option gap allows arbitrary local file read via --contents/-S | Oct 12, 2026 | |
| Fixed | Medium | GHSA-59cr-6r3x-644w: GitPython 3.1.61: Submodule.update() uses unchecked .gitmodules path, enabling repository escape | Oct 12, 2026 | |
| Fixed | Critical | GHSA-44vg-5wv2-h2hg: SimpleEval allows access to os/sys via attribute chains on passed names and callbacks | Oct 12, 2026 | |
| Fixed | Medium | GHSA-3wxw-xv34-2frg: GitPython TagReference.create positional reference bypasses unsafe guard enabling arbitrary file read | Oct 12, 2026 | |
| Fixed | Critical | GHSA-284h-m62q-gf8w: GitPython writer splits decoded multiline config into new directive, enabling core.hooksPath RCE | Oct 12, 2026 | |
| Fixed | High | GHSA-239g-whfq-7xj9: GitPython git_dir discovery bug enables RCE via tracked hooks; config exfiltration (CVE-2026-87817) | Oct 12, 2026 | |
| Fixed | High | GitPython <3.1.60 ReDoS in Actor.name_email_regex on malformed commit author field | Oct 12, 2026 | |
| Fixed | High | GitPython 3.1.59 high-level diff API fails to restrict --no-index, enabling arbitrary filesystem read oracle | Oct 12, 2026 | |
| Fixed | High | GitPython <3.1.60 trusts tracked gitdir/commondir/HEAD, enabling RCE via pre-commit hook | Oct 12, 2026 | |
| Fixed | High | GitPython <3.1.59 TagReference.create() arbitrary file read via positional --file reference bypass | Oct 12, 2026 | |
| Fixed | High | GitPython <3.1.59 denylist omission allows arbitrary file read via Repo.blame --contents/-S | Oct 12, 2026 | |
| Fixed | High | Omission of --separate-git-dir in GitPython <3.1.59 enables arbitrary dir creation, hook execution | Oct 12, 2026 | |
| Fixed | Critical | GitPython <3.1.59 mis-serializes multi-line config, activating injected directives and RCE | Oct 12, 2026 | |
| Fixed | High | GitPython <3.1.59 local file disclosure via .gitmodules include parsing error | Oct 12, 2026 | |
| Fixed | Medium | Apache Thrift Python bindings: improper TLS certificate host mismatch validation vulnerability before 0.24.0 | Oct 12, 2026 | |
| Fixed | Critical | Out-of-bounds read due to improper input quantity validation in Apache Thrift C++ <0.24.0 | Oct 12, 2026 | |
| Fixed | High | Resource allocation without limits vulnerability in Apache Thrift Rust bindings before 0.24.0 | Oct 12, 2026 | |
| Fixed | Critical | Out-of-bounds read vulnerability in Apache Thrift c_glib bindings before 0.24.0 | Oct 12, 2026 | |
| Fixed | Critical | Heap-based buffer overflow in Apache Thrift C++ bindings prior to version 0.24.0 | Oct 12, 2026 | |
| Fixed | Medium | Buffer over-read vulnerability in Apache Thrift C++ bindings prior to 0.24.0 | Oct 12, 2026 | |
| Fixed | High | Apache Thrift pre-0.24.0 integer overflow/wraparound vulnerability in C++, c_glib, Go, netstd, Delphi, Haxe | Oct 12, 2026 | |
| Fixed | High | Apache Thrift Node.js bindings vulnerable: unbounded resource allocation, inefficient complexity pre-0.24.0 | Oct 12, 2026 | |
| Fixed | High | Data amplification vulnerability in Apache Thrift Ruby bindings due to compressed data handling pre-0.24.0 | Oct 12, 2026 | |
| Fixed | High | Apache Thrift <0.24.0 data amplification vulnerability from improper handling of highly compressed data across bindings | Oct 12, 2026 | |
| Fixed | High | Improper certificate hostname validation in Apache Thrift C++ before 0.24.0 | Oct 12, 2026 | |
| Fixed | Critical | Apache Thrift c_glib: certificate host mismatch validation vulnerability before 0.24.0 | Oct 12, 2026 | |
| Fixed | High | Allocation of Resources Without Limits vulnerability in Apache Thrift Java bindings 0.19.0–0.23.x | Oct 12, 2026 | |
| Fixed | High | Infinite loop vulnerability in Apache Thrift Python/Go/PHP/Java bindings before 0.24.0 | Oct 12, 2026 | |
| Fixed | High | Multiple vulnerabilities in Apache Thrift before 0.23.0: origin validation, path traversal, CRLF, DoS. | Oct 12, 2026 | |
| Fixed | High | Apache Thrift before 0.23.0: improper TLS certificate host mismatch validation | Oct 12, 2026 | |
| Fixed | Medium | Memory allocation excessive size vulnerability in Apache Thrift before 0.23.0 | Oct 12, 2026 | |
| Fixed | High | Uncontrolled recursion vulnerability in Apache Thrift Node.js bindings prior to 0.23.0 | Oct 12, 2026 | |
| Fixed | High | Apache Thrift Python pre-0.24.0 data amplification vulnerability with highly compressed data | Oct 12, 2026 |
Make CVE remediation our job, not yours.
Tell us what you run. We'll show you what Determinate Secure Packages covers, how the SLA applies, and how to get started.