CVE-2024-45049: Nix Hydra Missing authentication when triggering evaluations
Hydra is a Continuous Integration service for Nix based projects. It is possible to trigger evaluations in Hydra without any authentication. Depending on the size of evaluations, this can impact the availability of systems. The problem can be fixed by applying https://github.com/NixOS/hydra/commit/f73043378907c2c7e44f633ad764c8bdd1c947d5 to any Hydra package. Users are advised to upgrade. Users unable to upgrade should deny the /api/push route in a reverse proxy. This also breaks the "Evaluate jobset" button in the frontend.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45049?
CVE-2024-45049 has been identified as a vulnerability that can affect the availability of systems using the Hydra continuous integration service.
How do I fix CVE-2024-45049?
To fix CVE-2024-45049, apply the recommended changes as specified in the NixOS Hydra security advisory.
What is affected by CVE-2024-45049?
CVE-2024-45049 impacts the NixOS Hydra service, particularly allowing unauthenticated evaluation triggers.
Can CVE-2024-45049 lead to denial of service?
Yes, CVE-2024-45049 can lead to denial of service by overwhelming systems with triggered evaluations.
Is authentication required for the vulnerability in CVE-2024-45049?
No, CVE-2024-45049 allows triggering evaluations in Hydra without any authentication.