# Recent vulnerabilities from OSV Haskell λ

## [hsec-2023-0006](https://vulnerability.circl.lu/vuln/hsec-2023-0006)

```json
{
  "affected": [
    {
      "database_specific": {
        "human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2023/HSEC-2023-0006.md",
        "osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2023/HSEC-2023-0006.json"
      },
      "package": {
        "ecosystem": "Hackage",
        "name": "x509-validation"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0"
            },
            {
              "fixed": "1.4.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "database_specific": {
    "home": "https://github.com/haskell/security-advisories",
    "osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export",
    "repository": "https://github.com/haskell/security-advisories"
  },
  "details": "# x509-validation does not enforce pathLenConstraint\n\n*x509-validation* prior to version 1.4.8 did not enforce the\npathLenConstraint value.  Constrained CAs could accidentally (or\ndeliberately) issue CAs below the maximum depth and\n*x509-validation* would accept certificates issued by the\nunauthorised intermediate CAs.\n",
  "id": "HSEC-2023-0006",
  "modified": "2025-11-14T14:45:34Z",
  "published": "2025-11-14T14:45:34Z",
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/haskell-tls/hs-certificate/commit/06d15dbbc53739314760d8504ca764000770e46e"
    }
  ],
  "schema_version": "1.5.0",
  "summary": "x509-validation does not enforce pathLenConstraint"
}
```

## [hsec-2023-0005](https://vulnerability.circl.lu/vuln/hsec-2023-0005)

```json
{
  "affected": [
    {
      "database_specific": {
        "human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2023/HSEC-2023-0005.md",
        "osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2023/HSEC-2023-0005.json"
      },
      "package": {
        "ecosystem": "Hackage",
        "name": "tls-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1.0"
            },
            {
              "fixed": "0.4.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2013-0243"
  ],
  "database_specific": {
    "home": "https://github.com/haskell/security-advisories",
    "osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export",
    "repository": "https://github.com/haskell/security-advisories"
  },
  "details": "# tls-extra: certificate validation does not check Basic Constraints\n\n*tls-extra* does not check the Basic Constraints extension of a\ncertificate in certificate chain processing.  Any certificate is\ntreated as a CA certificate.  As a consequence, anyone who has a\nvalid certificate can use it to sign another one (with an arbitrary\nsubject DN/domain name embedded into it) and have it accepted by\n*tls*.  This allows MITM attacks on TLS connections.\n",
  "id": "HSEC-2023-0005",
  "modified": "2025-11-14T14:45:34Z",
  "published": "2025-11-14T14:45:34Z",
  "references": [
    {
      "type": "DISCUSSION",
      "url": "https://www.openwall.com/lists/oss-security/2013/01/30/6"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/haskell-tls/hs-tls/issues/29"
    },
    {
      "type": "FIX",
      "url": "https://github.com/haskell-tls/hs-tls/commit/15885c0649ceabd2f4d2913df8ac6dc63d6b3b37"
    }
  ],
  "schema_version": "1.5.0",
  "summary": "tls-extra: certificate validation does not check Basic Constraints"
}
```

## [hsec-2023-0004](https://vulnerability.circl.lu/vuln/hsec-2023-0004)

```json
{
  "affected": [
    {
      "database_specific": {
        "human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2023/HSEC-2023-0004.md",
        "osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2023/HSEC-2023-0004.json"
      },
      "package": {
        "ecosystem": "Hackage",
        "name": "xml-conduit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.5.0"
            },
            {
              "fixed": "1.9.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-4249"
  ],
  "database_specific": {
    "home": "https://github.com/haskell/security-advisories",
    "osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export",
    "repository": "https://github.com/haskell/security-advisories"
  },
  "details": "# xml-conduit unbounded entity expansion\n\nA vulnerability was found in *xml-conduit*. It has been classified\nas problematic.  Affected is an unknown function of the file\n`xml-conduit/src/Text/XML/Stream/Parse.hs` of the component DOCTYPE\nEntity Expansion Handler. The manipulation leads to infinite loop.\nIt is possible to launch the attack remotely. Upgrading to version\n1.9.1.0 is able to address this issue. The name of the patch is\n`4be1021791dcdee8b164d239433a2043dc0939ea`. It is recommended to\nupgrade the affected component.\n",
  "id": "HSEC-2023-0004",
  "modified": "2025-11-14T14:45:34Z",
  "published": "2025-11-14T14:45:34Z",
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/snoyberg/xml/pull/161"
    },
    {
      "type": "FIX",
      "url": "https://github.com/snoyberg/xml/commit/4be1021791dcdee8b164d239433a2043dc0939ea"
    }
  ],
  "schema_version": "1.5.0",
  "summary": "xml-conduit unbounded entity expansion"
}
```

## [hsec-2023-0003](https://vulnerability.circl.lu/vuln/hsec-2023-0003)

```json
{
  "affected": [
    {
      "database_specific": {
        "human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2023/HSEC-2023-0003.md",
        "osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2023/HSEC-2023-0003.json"
      },
      "package": {
        "ecosystem": "Hackage",
        "name": "xmonad-contrib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.5"
            },
            {
              "fixed": "0.11.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": [
        {
          "score": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "type": "CVSS_V2"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2013-1436"
  ],
  "database_specific": {
    "home": "https://github.com/haskell/security-advisories",
    "osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export",
    "repository": "https://github.com/haskell/security-advisories"
  },
  "details": "# code injection in *xmonad-contrib*\n\nThe `XMonad.Hooks.DynamicLog` module in _xmonad-contrib_ before\n**0.11.2** allows remote attackers to execute arbitrary commands via a\nweb page title, which activates the commands when the user clicks on\nthe xmobar window title, as demonstrated using an action tag.\n",
  "id": "HSEC-2023-0003",
  "modified": "2025-11-14T14:45:34Z",
  "published": "2025-11-14T14:45:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security.gentoo.org/glsa/201405-28"
    },
    {
      "type": "DISCUSSION",
      "url": "http://www.openwall.com/lists/oss-security/2013/07/26/5"
    },
    {
      "type": "FIX",
      "url": "https://github.com/xmonad/xmonad-contrib/commit/d3b2a01e3d01ac628e7a3139dd55becbfa37cf51"
    }
  ],
  "schema_version": "1.5.0",
  "summary": "code injection in xmonad-contrib"
}
```

## [hsec-2023-0002](https://vulnerability.circl.lu/vuln/hsec-2023-0002)

```json
{
  "affected": [
    {
      "database_specific": {
        "human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2023/HSEC-2023-0002.md",
        "osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2023/HSEC-2023-0002.json"
      },
      "package": {
        "ecosystem": "Hackage",
        "name": "biscuit-haskell"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1.0.0"
            },
            {
              "fixed": "0.2.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-31053"
  ],
  "database_specific": {
    "home": "https://github.com/haskell/security-advisories",
    "osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export",
    "repository": "https://github.com/haskell/security-advisories"
  },
  "details": "# Improper Verification of Cryptographic Signature\n\nThe Biscuit specification version 1 contains a vulnerable algorithm that allows\nmalicious actors to forge valid Γ-signatures. Such an attack would allow an\nattacker to create a token with any access level. The version 2 of the\nspecification mandates a different algorithm than gamma signatures and as such\nis not affected by this vulnerability.\n",
  "id": "HSEC-2023-0002",
  "modified": "2025-11-14T14:45:34Z",
  "published": "2025-11-14T14:45:34Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://eprint.iacr.org/2020/1484"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/biscuit-auth/biscuit/security/advisories/GHSA-75rw-34q6-72cr"
    }
  ],
  "related": [
    "GHSA-75rw-34q6-72cr"
  ],
  "schema_version": "1.5.0",
  "summary": "Improper Verification of Cryptographic Signature"
}
```

## [hsec-2023-0001](https://vulnerability.circl.lu/vuln/hsec-2023-0001)

```json
{
  "affected": [
    {
      "database_specific": {
        "human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2023/HSEC-2023-0001.md",
        "osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2023/HSEC-2023-0001.json"
      },
      "package": {
        "ecosystem": "Hackage",
        "name": "aeson"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.4.0.0"
            },
            {
              "fixed": "2.0.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-3433"
  ],
  "database_specific": {
    "home": "https://github.com/haskell/security-advisories",
    "osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export",
    "repository": "https://github.com/haskell/security-advisories"
  },
  "details": "# Hash flooding vulnerability in aeson\n\n*aeson* was vulnerable to hash flooding (a.k.a. hash DoS).  The\nissue is a consequence of the HashMap implementation from\n*unordered-containers*.  It results in a denial of service through\nCPU consumption.  This technique has been used in real-world attacks\nagainst a variety of languages, libraries and frameworks over the\nyears.\n",
  "id": "HSEC-2023-0001",
  "modified": "2025-11-14T14:45:34Z",
  "published": "2025-11-14T14:45:34Z",
  "references": [
    {
      "type": "ARTICLE",
      "url": "https://cs-syd.eu/posts/2021-09-11-json-vulnerability"
    },
    {
      "type": "ARTICLE",
      "url": "https://frasertweedale.github.io/blog-fp/posts/2021-10-12-aeson-hash-flooding-protection.html"
    },
    {
      "type": "DISCUSSION",
      "url": "https://github.com/haskell/aeson/issues/864"
    }
  ],
  "schema_version": "1.5.0",
  "summary": "Hash flooding vulnerability in aeson"
}
```