CVE-2024-45049: nixos hydra

csirt@kutim:~/threat-intel/cve/CVE-2024-45049

CVSS 7.5 · High EPSS 0,62%

Kerentanan Missing Authentication for Critical Function pada nixos hydra. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Hydra is a Continuous Integration service for Nix based projects. It is possible to trigger evaluations in Hydra without any authentication. Depending on the size of evaluations, this can impact the availability of systems. The problem can be fixed by applying https://github.com/NixOS/hydra/commit/f73043378907c2c7e44f633ad764c8bdd1c947d5 to any Hydra package. Users are advised to upgrade. Users unable to upgrade should deny the `/api/push` route in a reverse proxy. This also breaks the "Evaluate jobset" button in the frontend.

Rincian

Terbit di NVD: 27 Agustus 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-306: Missing Authentication for Critical Function
EPSS (30 hari): 0,62% peluang dieksploitasi; lebih tinggi dari 48,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
nixos	hydra	Semua versi sebelum 2024-08-27

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/NixOS/hydra/security/advisories/GHSA-xv29-v93r-2f5v patch · advisory vendor
https://github.com/NixOS/hydra/commit/f73043378907c2c7e44f633ad764c8bdd1c947d5 patch
https://github.com/NixOS/nixpkgs/pull/337766 issue tracking · patch
https://mastodon.delroth.net/@delroth/113029832631860419 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.