← All distributions
Updated 10:00
Determinate Secure Packages distribution
secure-packages-rollingSupportedFIPS supported
Built on Nixpkgs master. Available for use in production environments and covered by our standard service-level agreement (SLA).
Fixed in the last 30 days
234
Fixed in the last 7 days
119
In progress
370
Use this distribution
Customers onlyDeterminate Secure Packages is available through FlakeHub to organizations with access. Not a customer yet? Get in touch to gain access or schedule a demo.
Standardflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling/0";
}FIPS variant
FIPS variantflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling-fips/0";
}The FIPS variant is the package set with Federal Information Processing Standards (FIPS) mode enabled. Using the FIPS variant has the details.
604 CVEs tracked
| CVE | Status | Severity | Summary | Fixed |
|---|---|---|---|---|
| Fixed | High | PyJWT 2.4.0–2.13.x: DER public key accepted as HMAC secret enables JWT forgery | Oct 9, 2026 | |
| Fixed | Medium | PyJWT <2.14.0 is_pem_format regex backtracking causes CPU DoS on malformed PEM input | Oct 9, 2026 | |
| Fixed | Medium | PyJWT <2.14.0 signature decoding accepts non-Base64URL chars, causing equivalent-token revocation bypass | Oct 9, 2026 | |
| Fixed | Critical | PyJWT pre-2.14.0 PEM detection bug allows HMAC token forgery with public keys | Oct 9, 2026 | |
| Fixed | Critical | PyJWT <2.14.0 PyJWKClient follows unvalidated JWKS redirects, allowing key substitution and credential disclosure | Oct 9, 2026 | |
| Fixed | Critical | PyJWT 2.13–2.14 HMAC from_jwk skips prepare_key; empty 'k' enables zero-key JWT forgery | Oct 9, 2026 | |
| Fixed | Medium | PyJWT 2.13.x: deeply nested token header triggers unhandled RecursionError, causing HTTP 500 | Oct 9, 2026 | |
| Fixed | High | PyJWT pre-2.14.0: unknown kid forces JWKS refresh, enabling outbound request amplification | Oct 9, 2026 | |
| Fixed | Medium | Hugo text/org content renders unescaped HTML, enabling XSS in v0.56.0–v0.165.x | Oct 9, 2026 | |
| Fixed | High | Mixed-case URL schemes bypass Hugo security.http.urls IP-literal deny in v0.162–0.165 | Oct 9, 2026 | |
| Fixed | High | Hugo v0.123.1–v0.165.x: symlinked mount roots expose external files via themes/modules | Oct 9, 2026 | |
| Fixed | Medium | Stored XSS in Hugo 0.75–0.165.x via unescaped lineAnchors in syntax highlighting | Oct 9, 2026 | |
| Fixed | High | Hugo v0.161–0.165 Node permission symlink bypass allows reading files outside project mounts | Oct 9, 2026 | |
| Fixed | Medium | UCSI debugfs entries persist after unregister, causing duplicate directory errors on re-registration | Oct 9, 2026 | |
| Fixed | Medium | iwlwifi: MEI passes q_head instead of cldev to iwl_mei_write_cyclic_buf | Oct 9, 2026 | |
| Fixed | Medium | drm/msm: Retiring hung submit before GPU recovery frees BOs, causing GPU page faults | Oct 9, 2026 | |
| Fixed | Medium | rtl8723bs mgmt xmit_frame/xmit_buf leak on error exhausts TX pools, breaking beacons/responses | Oct 9, 2026 | |
| Fixed | Critical | RDMA/srpt: srpt_alloc_rw_ctxs failure leaves stale counters, dangling rw_ctxs, wrong sq_wr_avail accounting | Oct 9, 2026 | |
| Fixed | Medium | bpf_refcount field not marked unique in Linux kernel BPF subsystem | Oct 9, 2026 | |
| Fixed | High | Expat ≤2.8.3 DoS: quadratic complexity in storeAtts() attribute handling triggers CPU exhaustion | Oct 5, 2026 | |
| Fixed | Critical | Perl <=5.43.9 regex alternation >65535 overflows trie field causing silent mismatches | Oct 5, 2026 | |
| Fixed | High | PCRE2 <10.48 pcre2_jit_match mishandles copied subject context, causing incorrect free | Oct 5, 2026 | |
| Fixed | Medium | strongSwan libcharon 5.9.7–6.0.7 mishandles IKEv2 CREATE_CHILD_SA, enabling authentication bypass | Oct 4, 2026 | |
| Fixed | High | strongSwan 4.5.0–6.0.7: eap-ttls/peap incorrect access control via missing/mismatched inner EAP identity | Oct 4, 2026 | |
| Fixed | High | Use-after-free in libcharon IKEv2 rekeying collision handling (strongSwan 6.0.0–6.0.7) | Oct 4, 2026 | |
| Fixed | High | strongSwan 4.2.0 through 6.0.7: NULL pointer dereference in x509 attribute certificate parser | Oct 4, 2026 | |
| Fixed | Medium | Infinite loop vulnerability in strongSwan PKCS#5 decryption (versions 4.6.2–6.0.7) | Oct 4, 2026 | |
| Fixed | Low | libcharon memory leak in IKE message parser affects strongSwan 4.1.2–6.0.7 | Oct 4, 2026 | |
| Fixed | Medium | NULL pointer dereference vulnerability in strongSwan eap-aka plugin (4.1.10–6.0.7) | Oct 4, 2026 | |
| Fixed | Low | strongSwan 5.0.2–6.0.7 openssl plugin PKCS#7 enumeration memory leak | Oct 4, 2026 | |
| Fixed | Medium | strongSwan openssl plugin PKCS#7 parsing expired pointer dereference vulnerability (5.0.2–6.0.7) | Oct 4, 2026 | |
| Fixed | Medium | GNU Bison improperly trusts %output/%header paths, overriding caller options and overwriting arbitrary files | Oct 4, 2026 | |
| Fixed | Medium | dhcpcd ≤10.3.2 heap use-after-free in control socket; local unprivileged exploitation | Oct 4, 2026 | |
| Fixed | High | dhcpcd ≤10.3.2 IPv6 RA route info memory leak enables unauthenticated same-link DoS crash | Oct 4, 2026 | |
| Fixed | Medium | dhcpcd ≤10.3.2 DHCPv6 RENEW PD_EXCLUDE use-after-free enables unauthenticated same-link crash | Oct 4, 2026 | |
| Fixed | High | Stack overflow in libsass 3.6.5-8-g210218 Sass::CompoundSelector::has_real_parent_ref causing DoS; affects sassc 3.6.2 | Oct 4, 2026 | |
| Fixed | High | Email change confirmation bug lets attackers hijack RubyGems.org accounts and publish/yank gems | Oct 4, 2026 | |
| Fixed | Medium | Zstandard <1.4.1 output files default permissions until completion, allowing unintended access | Oct 4, 2026 | |
| Fixed | High | Zstandard <1.3.8 one-pass compression race condition allows out-of-bounds write with undersized output buffer | Oct 4, 2026 | |
| Fixed | High | libplist plist_free_data crash via integer node misclassified as PLIST_KEY causing invalid free | Oct 4, 2026 | |
| Fixed | High | libplist DoS via zero offset size causing large memory allocation and crash | Oct 4, 2026 | |
| Fixed | Medium | libplist bplist.c parse_dict_node out-of-bounds heap read causes DoS crash via crafted file | Oct 4, 2026 | |
| Fixed | High | ClamAV libclamav remote DoS via crafted document causing AMP restart on Cisco ESA/WSA | Oct 4, 2026 | |
| Fixed | Medium | libxml2 XInclude fails to propagate parseFlags pre-2.15.4, bypassing XML_PARSE_NONET and enabling XXE/SSRF/DoS | Oct 3, 2026 | |
| Fixed | Medium | libxml2 xmlIO before 2.15.4 passes negative write lengths due to integer overflow | Oct 3, 2026 | |
| Fixed | Medium | libxml2 <2.15.4: heap-based buffer overflow in xmlXPtrEvalXPtrPart via xpointer length saturation | Oct 3, 2026 | |
| Fixed | Low | libxml2 <2.15.4: xmlregexp NULL dereference in xmlRegNewParserCtxt after strdup failure | Oct 3, 2026 | |
| Fixed | High | libxml2 <2.15.4 xmlSnprintfElements stack-based buffer overflow via strcat in valid.c | Oct 3, 2026 | |
| Fixed | Medium | Integer overflow in libxml2 xmlURIEscapeStr (uri.c) before 2.15.4 | Oct 3, 2026 | |
| Fixed | Medium | libxml2 <2.15.4: xmlDictAddQString integer overflow and heap buffer overflow in dict.c | Oct 3, 2026 |
Make CVE remediation our job, not yours.
Tell us what you run. We'll show you what Determinate Secure Packages covers, how the SLA applies, and how to get started.