CVE-2024-47174

Nix is a package manager for Linux and other Unix systems. Starting in version 1.11 and prior to versions 2.18.8 and 2.24.8, `<nix/fetchurl.nix>` did not verify TLS certificates on HTTPS connections. This could lead to connection details such as full URLs or credentials leaking in case of a man-in-the-middle (MITM) attack. `<nix/fetchurl.nix>` is also known as the builtin derivation builder `builtin:fetchurl`. It's not to be confused with the evaluation-time function `builtins.fetchurl`, which was not affected by this issue. A user may be affected by the risk of leaking credentials if they have a `netrc` file for authentication, or rely on derivations with `impureEnvVars` set to use credentials from the environment. In addition, the commonplace trust-on-first-use (TOFU) technique of updating dependencies by specifying an invalid hash and obtaining it from a remote store was also vulnerable to a MITM injecting arbitrary store objects. This also applied to the impure derivations experimental feature. Note that this may also happen when using Nixpkgs fetchers to obtain new hashes when not using the fake hash method, although that mechanism is not implemented in Nix itself but rather in Nixpkgs using a fixed-output derivation. The behavior was introduced in version 1.11 to make it consistent with the Nixpkgs `pkgs.fetchurl` and to make `<nix/fetchurl.nix>` work in the derivation builder sandbox, which back then did not have access to the CA bundles by default. Nowadays, CA bundles are bind-mounted on Linux. This issue has been fixed in Nix 2.18.8 and 2.24.8. As a workaround, implement (authenticated) fetching with `pkgs.fetchurl` from Nixpkgs, using `impureEnvVars` and `curlOpts` as needed.

• CWE-287

• https://github.com/NixOS/nix/commit/062b4a489e30da9c85fa4ff15cfdd2e51cac7b90
• https://github.com/NixOS/nix/commit/5db358d4d78aea7204a8f22c5bf2a309267ee038
• https://github.com/NixOS/nix/pull/11585
• https://github.com/NixOS/nix/security/advisories/GHSA-6fjr-mq49-mm2c

Published

Sep 26, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-47169Agnai is an artificial-intelligence-agnostic multi-user, mul…8.8
• CVE-2024-4717A vulnerability was found in Campcodes Complete Web-Based Sc…6.1
• CVE-2024-47170Agnai is an artificial-intelligence-agnostic multi-user, mul…4.3
• CVE-2024-47171Agnai is an artificial-intelligence-agnostic multi-user, mul…4.3
• CVE-2024-47172Computer Vision Annotation Tool (CVAT) is an interactive vid…5.4
• CVE-2024-47173Aimeos is an e-commerce framework. All SaaS and marketplace …5.5
• CVE-2024-47175CUPS is a standards-based, open-source printing system, and …9.8
• CVE-2024-47176CUPS is a standards-based, open-source printing system, and …5.3
• CVE-2024-47177Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-47178basic-auth-connect is Connect's Basic Auth middleware in its…5.3
• CVE-2024-47179RSSHub is an RSS network. Prior to commit 64e00e7, RSSHub's …8.8
• CVE-2024-4718A vulnerability was found in Campcodes Complete Web-Based Sc…6.1