Skip to content

CVE-2023-32681 - outdated python3.10-requests-2.29.0 #144

@ghostbuster91

Description

@ghostbuster91

Nix refuses to build openconnect-sso with provided flake due to outdated and vulnerable dependency.

building the system configuration...
error: Package ‘python3.10-requests-2.29.0’ in /nix/store/6s86padm2iikrwhlq8nwfv0lw9d1sbvq-source/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/poetry.lock:0 is marked as insecure, refusing to evaluate.


       Known issues:
        - CVE-2023-32681

       You can install it anyway by allowing this package, using the
       following methods:

       a) To temporarily allow all insecure packages, you can use an environment
          variable for a single invocation of the nix tools:

            $ export NIXPKGS_ALLOW_INSECURE=1

        Note: For `nix shell`, `nix build`, `nix develop` or any other Nix 2.4+
        (Flake) command, `--impure` must be passed in order to read this
        environment variable.

       b) for `nixos-rebuild` you can add ‘python3.10-requests-2.29.0’ to
          `nixpkgs.config.permittedInsecurePackages` in the configuration.nix,
          like so:

            {
              nixpkgs.config.permittedInsecurePackages = [
                "python3.10-requests-2.29.0"
              ];
            }

       c) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
          ‘python3.10-requests-2.29.0’ to `permittedInsecurePackages` in
          ~/.config/nixpkgs/config.nix, like so:

            {
              permittedInsecurePackages = [
                "python3.10-requests-2.29.0"
              ];
            }
(use '--show-trace' to show detailed location information)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions