Security Advisory: Unsafe handling of credentials in `pkgs.fetchurl`

Announcements Security
1

Summary

pkgs.fetchurl from nixpkgs does not verify TLS certificates when downloading content
with a known hash.

This is particularly problematic when downloading content that requires authentication as the credentials used can be leaked in case of a man-in-the-middle (MITM) attack.

Am I affected?

You are affected if you use pkgs.fetchurl from nixpkgs with the netrcPhase input set.

Patches

TLS verification is enforced when netrcPhase is set since the following patches:

Acknowledgement

This issue was spotted by @tomberek after the report of a similar vulnerability in Nix by Pierre-Etienne Meunier.

9 Likes