{"action":"created","issue":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/12035","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/12035/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/12035/comments","events_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/12035/events","html_url":"https://github.com/NixOS/nixpkgs/issues/12035","id":124351515,"number":12035,"title":"Package Vulnerability Scanner","user":{"login":"jgillich","id":347965,"avatar_url":"https://avatars.githubusercontent.com/u/347965?v=3","gravatar_id":"","url":"https://api.github.com/users/jgillich","html_url":"https://github.com/jgillich","followers_url":"https://api.github.com/users/jgillich/followers","following_url":"https://api.github.com/users/jgillich/following{/other_user}","gists_url":"https://api.github.com/users/jgillich/gists{/gist_id}","starred_url":"https://api.github.com/users/jgillich/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jgillich/subscriptions","organizations_url":"https://api.github.com/users/jgillich/orgs","repos_url":"https://api.github.com/users/jgillich/repos","events_url":"https://api.github.com/users/jgillich/events{/privacy}","received_events_url":"https://api.github.com/users/jgillich/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-12-30T14:01:19Z","updated_at":"2015-12-30T14:21:26Z","closed_at":null,"body":"I wrote a little program to do automatic vulnerability scanning of nixpkgs, based on the NVE CVE database.\r\n\r\nIt detects a bit over 100 vulnerabilities in all 15.09 packages. This number includes a lot of false positives, the checking is based on version numbers and does not (yet) detect patches.\r\nHere is the list: https://gist.github.com/jgillich/f842c97702d2de61a6eb\r\n\r\nMost of the older CVEs have been patched manually, but some haven't. For example XChat, a program with the last upstream release in 2010 and a vulnerability reported in 2011 that allows to \"possibly execute arbitrary code\". I think we need to remove such unmaintained packages wherever possible, patching them forever is not sustainable.\r\n\r\nCode for the program is [here](https://github.com/jgillich/nix-audit), written in Node. Thanks to streams Node works pretty well, but there doesn't seem to be a library to parse anything else than semantic versions, so stuff like `1.0.1q` from OpenSSL just gets ignored. It's just a prototype and doesn't interact with the local nixpkgs, so if another language would be a better fit, I'm open to rewriting it."},"comment":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/comments/168009625","html_url":"https://github.com/NixOS/nixpkgs/issues/12035#issuecomment-168009625","issue_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/12035","id":168009625,"user":{"login":"vcunat","id":1785925,"avatar_url":"https://avatars.githubusercontent.com/u/1785925?v=3","gravatar_id":"","url":"https://api.github.com/users/vcunat","html_url":"https://github.com/vcunat","followers_url":"https://api.github.com/users/vcunat/followers","following_url":"https://api.github.com/users/vcunat/following{/other_user}","gists_url":"https://api.github.com/users/vcunat/gists{/gist_id}","starred_url":"https://api.github.com/users/vcunat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vcunat/subscriptions","organizations_url":"https://api.github.com/users/vcunat/orgs","repos_url":"https://api.github.com/users/vcunat/repos","events_url":"https://api.github.com/users/vcunat/events{/privacy}","received_events_url":"https://api.github.com/users/vcunat/received_events","type":"User","site_admin":false},"created_at":"2015-12-30T14:21:26Z","updated_at":"2015-12-30T14:21:26Z","body":"Note: we already have http://monitor.nixos.org/vulnerable (written in ruby), but there seems something wrong in there as I haven't got any updates to the [feed](http://monitor.nixos.org/vulnerable?rss=on) for several months &ndash; /cc @phreedom for that."}}