Expired Key Policies in cabal-install
Summary
HSEC-2023-0015: cabal-install uses expired key policies. Affects cabal-install versions >= 1.24.0.0, < 3.10.2.0. Fixed in 3.10.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cabal-install is a package management tool for Haskell that allows users to easily install and manage libraries and applications. It is widely used in the Haskell community and is an essential component of the Haskell ecosystem. However, a vulnerability has been discovered in cabal-install's implementation of the Hackage Security protocol. This vulnerability could potentially allow an attacker to deliver malicious packages by exploiting expired key policies. The Hackage Security protocol is designed to ensure the integrity and security of packages on the Hackage repository.
Vulnerability Detail
The vulnerability in cabal-install arises from a bug that causes it to skip the verification of the key policy file's expiration timestamp. This means that older versions of cabal-install, which have not been patched, could be vulnerable to a man-in-the-middle attack or a malicious mirror. If a user has not connected to Hackage in a long time, even after the policy file has expired, they could be exposed to the delivery of malicious or obsolete package indexes. Although no operational keys have been revoked at this time, it is important to update to version 3.10.2.0 or newer to mitigate the risk of future key revocations.
How To Fix
Minimum fixed version
3.10.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in cabal-install's handling of expired key policies poses a potential risk to the integrity and security of packages. It is important for users to update to version 3.10.2.0 or newer to mitigate this risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cabal-install →
FAQ
cabal-install is a package management tool for Haskell that allows users to easily install and manage libraries and applications.
The Hackage Security protocol is an implementation of The Update Framework, which is a design for a package repository that ensures the integrity and security of packages. It prevents the insertion of malicious code and ensures that mirrors cannot maliciously deny security updates.
The vulnerability in cabal-install is caused by a bug that skips the verification of the key policy file's expiration timestamp. This allows older versions of cabal-install to be vulnerable to man-in-the-middle attacks or malicious mirrors, potentially leading to the delivery of malicious or obsolete package indexes.
No, there have been no reports of this vulnerability being exploited. However, it is important to update to the latest version of cabal-install to mitigate the risk of future key revocations.
To update cabal-install, you can follow the instructions provided by the Haskell community or use your Linux distribution's package manager to install the latest version.
References
Related vulnerabilities
Recent vulnerabilities recorded for cabal-install.
