← All distributions
Updated 13:00
Determinate Secure Packages distribution
secure-packages-rollingSupportedFIPS supported
Built on Nixpkgs master. Available for use in production environments and covered by our standard service-level agreement (SLA).
Fixed in the last 30 days
234
Fixed in the last 7 days
119
In progress
370
Use this distribution
Customers onlyDeterminate Secure Packages is available through FlakeHub to organizations with access. Not a customer yet? Get in touch to gain access or schedule a demo.
Standardflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling/0";
}FIPS variant
FIPS variantflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling-fips/0";
}The FIPS variant is the package set with Federal Information Processing Standards (FIPS) mode enabled. Using the FIPS variant has the details.
604 CVEs tracked
| CVE | Status | Severity | Summary | Fixed |
|---|---|---|---|---|
| In progress | High | REXML gem <3.3.9 ReDoS parsing hex numeric character references; only affects Ruby 3.1 | — | |
| In progress | Critical | tarfile misinterprets crafted archives by normalizing AREGTYPE during GNUTYPE_LONGNAME/LONGLINK processing | — | |
| In progress | Medium | Pytest ≤9.0.2 UNIX /tmp/pytest-of-{user} tmpdir allows local DoS/privilege escalation | — | |
| In progress | Medium | ReDoS vulnerability in Yarn <=1.22.22 explodeHostedGitFragment (hosted-git-resolver.js), remotely exploitable | — | |
| In progress | Medium | Yarn <=1.22.22 setOptions in request-manager.js ReDoS via inefficient regex; local access | — | |
| In progress | High | PyJWT pre-2.15.0 unhandled RecursionError in get_signing_key_from_jwt via nested payload causes 500s | — | |
| In progress | High | PyJWT <2.15.0 OKPAlgorithm.from_jwk doesn't verify x matches d; token replay risk | — | |
| In progress | Critical | Incorrect authorization in Chrome Site Isolation pre-155.0.8059.39 enables RCE via crafted HTML | — | |
| In progress | Medium | Pre-3.1.9 Werkzeug safe_join allows NUL: ADS paths on Windows, causing read hangs | — | |
| In progress | High | virtualenv pre-21.7.13 activation scripts command injection due to surplus quoting | — | |
| In progress | High | virtualenv <21.7.12 fails to verify seed wheel digests, enabling malicious wheel injection | — | |
| In progress | High | virtualenv <21.7.12 Windows activation yields command injection via attacker-controlled prompt | — | |
| In progress | Medium | virtualenv pre-21.7.11 prompt injection alters pyvenv.cfg keys, hijacking base interpreter | — | |
| In progress | Medium | Mako Windows path mismatch allows directory traversal, file disclosure via attacker-controlled template URIs pre-1.4.2 | — | |
| In progress | Medium | multidict C items-view union/subtraction leak references, causing unbounded memory growth (6.7–6.9.1) | — | |
| In progress | Medium | Chrome <155.0.8059.39 WebAppInstalls UI misrepresentation enables remote UI spoofing via crafted HTML (Low severity) | — | |
| In progress | Low | Animation timing side-channel in Chrome <155.0.8059.39 leaks cross-origin data | — | |
| In progress | Medium | DevTools reference resolution bug exposes sensitive data via crafted HTML in compromised renderer | — | |
| In progress | Medium | Chrome <155.0.8059.39 Paint UI misrepresentation allows remote UI spoofing via crafted HTML | — | |
| In progress | Medium | Missing authorization in Chrome Chromoting on Windows pre-155.0.8059.39 enables remote info disclosure | — | |
| In progress | Medium | Chrome <155.0.8059.39 Media uninitialized resource enabled remote cross-origin data leak via crafted HTML | — | |
| In progress | Medium | Chrome <155.0.8059.39 Viz input validation allows compromised renderer to bypass system access via crafted HTML | — | |
| In progress | High | Chrome Windows CredentialProvider uncontrolled search path enables local code execution outside sandbox pre-155.0.8059.39 | — | |
| In progress | Medium | Missing authorization in Chrome Permissions pre-155.0.8059.39 allows compromised renderer to spoof UI | — | |
| In progress | High | Confused deputy in Android Chrome SignIn pre-155.0.8059.39 enables remote privileged page access | — | |
| In progress | High | iOS Chrome Reader Mode code injection enables origin policy bypass via crafted HTML pre-155.0.8059.39 | — | |
| In progress | High | Chrome Media use-after-free enables sandboxed RCE via crafted HTML prior to 155.0.8059.39 | — | |
| In progress | High | Missing Actor authorization allows sandbox escape via crafted HTML in Chrome <155.0.8059.39 | — | |
| In progress | Medium | Chrome iOS <155.0.8059.39 local physical-access information leak vulnerability | — | |
| In progress | High | Chrome Parser use-after-free allows sandboxed RCE via crafted HTML prior to 155.0.8059.39 | — | |
| In progress | High | Missing authorization in Chrome WebAppInstalls enables sandbox escape RCE via crafted HTML pre-155.0.8059.39 | — | |
| In progress | Critical | Chromoting authorization bug in Mac Chrome allowed remote system access bypass via crafted traffic pre-155.0.8059.39 | — | |
| In progress | High | iOS Chrome pre-155.0.8059.39 missing navigation authorization enables origin bypass via crafted HTML to privileged page | — | |
| In progress | Critical | Critical Chrome Browser use-after-free allows RCE outside sandbox pre-155.0.8059.39 via crafted HTML | — | |
| In progress | High | Chrome <155.0.8059.39 FileSystem auth flaw enables renderer-compromised web origin policy bypass via crafted HTML page | — | |
| In progress | High | Chrome Android <155.0.8059.39 Actor auth bug allows compromised renderer to bypass site isolation | — | |
| In progress | High | Use-after-free in Chrome Track pre-155.0.8059.39 allows sandboxed RCE via crafted HTML | — | |
| In progress | High | V8 race condition in Chrome pre-155.0.8059.39 allows remote sandboxed code execution via crafted HTML | — | |
| In progress | Medium | Chrome Windows ANGLE uninitialized resource enables remote out-of-sandbox memory read via crafted HTML | — | |
| In progress | High | Pre-155.0.8059.39 Chrome for iOS Autofill cleanup flaw enabled exfiltration via socially engineered HTML | — | |
| In progress | High | Use-after-free in Chrome PDF allows sandboxed RCE before 155.0.8059.39 | — | |
| In progress | High | Android Chrome <155.0.8059.39 Passwords auth flaw allows site isolation bypass after renderer compromise | — | |
| In progress | Medium | iOS Chrome <155.0.8059.39 input validation flaw leaks data via crafted network traffic | — | |
| In progress | High | V8 race condition in Chrome <155.0.8059.39 enables remote code execution in renderer sandbox via HTML | — | |
| In progress | Medium | Chrome <155.0.8059.39 API authorization bug leaks data via crafted extension, social engineering | — | |
| In progress | Medium | iOS Chrome <155.0.8059.39 address bar spoofing by remote attacker via crafted HTML | — | |
| In progress | Low | Chrome Scroll bug pre-155.0.8059.39 leaks cross-origin data via crafted extension | — | |
| In progress | Critical | Chrome TabStrip use-after-free allows RCE outside sandbox via crafted HTML (pre-155.0.8059.39) | — | |
| In progress | High | Chrome Autofill authorization flaw pre-155.0.8059.39 enables data theft via crafted HTML, social engineering | — | |
| In progress | Medium | WebAudio race condition in Chrome <155.0.8059.39 leaks cross-origin data via crafted HTML | — |
Make CVE remediation our job, not yours.
Tell us what you run. We'll show you what Determinate Secure Packages covers, how the SLA applies, and how to get started.