Affected: Hackage: aeson

# Hash flooding vulnerability in aeson

*aeson* was vulnerable to hash flooding (a.k.a. hash DoS). The issue is a consequence of the HashMap implementation from *unordered-containers*. It results in a denial of service through CPU consumption. This technique has been used in real-world attacks against a variety of languages, libraries and frameworks over the years.

Affected: Hackage: biscuit-haskell

# Improper Verification of Cryptographic Signature

The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability.

Affected: Hackage: xmonad-contrib

# code injection in *xmonad-contrib*

The `XMonad.Hooks.DynamicLog` module in _xmonad-contrib_ before **0.11.2** allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.

Affected: Hackage: xml-conduit

# xml-conduit unbounded entity expansion

A vulnerability was found in *xml-conduit*. It has been classified as problematic. Affected is an unknown function of the file `xml-conduit/src/Text/XML/Stream/Parse.hs` of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack remotely. Upgrading to version 1.9.1.0 is able to address this issue. The name of the patch is …

Affected: Hackage: tls-extra

# tls-extra: certificate validation does not check Basic Constraints

*tls-extra* does not check the Basic Constraints extension of a certificate in certificate chain processing. Any certificate is treated as a CA certificate. As a consequence, anyone who has a valid certificate can use it to sign another one (with an arbitrary subject DN/domain name embedded into it) and have it accepted by *tls*. This allows MITM attacks on TLS c…

Affected: Hackage: x509-validation

# x509-validation does not enforce pathLenConstraint

*x509-validation* prior to version 1.4.8 did not enforce the pathLenConstraint value. Constrained CAs could accidentally (or deliberately) issue CAs below the maximum depth and *x509-validation* would accept certificates issued by the unauthorised intermediate CAs.

Affected: Hackage: base, Hackage: toml-reader

# `readFloat`: memory exhaustion with large exponent

`Numeric.readFloat` takes time and memory linear in the size of the number _denoted_ by the input string. In particular, processing a number expressed in scientific notation with a very large exponent could cause a denial of service. The slowdown is observable on a modern machine running GHC 9.4.4:

``` ghci> import qualified Numeric ghci> Numeric.rea…

Affected: Hackage: hledger-web

# Stored XSS in *hledger-web*

An issue was discovered in *hledger-web* < 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in `toBloodhoundJson` that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the `atob` function.

*hledger-web* forms sanitise obvious JavaScript, but not obfuscated JavaScript (see [OWASP Filter Evasion Cheat Sheet]…

Affected: Hackage: git-annex

# *git-annex* command injection via malicious SSH hostname

*git-annex* was vulnerable to the same class of security hole as git's **CVE-2017-1000117**. In several cases, `git-annex` parses a repository URL, and uses it to generate a `ssh` command, with the hostname to ssh to coming from the URL. If the hostname it parses is something like `-eProxyCommand=evil`, this could result in arbitrary local code execution.

Some deta…

Affected: Hackage: git-annex

# *git-annex* private data exfiltration to compromised remote

Some uses of git-annex were vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the *git-annex* repository, or content from a private web server on localhost or the LAN. Joey Hess discovered this attack.

To perform this attack, the attacker needs to have control over one of the remotes of the victim…