Ecosystem
Hackage
36 known vulnerabilities.
Most affected packages
git-annex 5
hackage-server 3
aeson 2
biscuit-haskell 2
x509-validation 2
base 2
cabal-install 2
scientific 2
xmonad-contrib 1
xml-conduit 1
tls-extra 1
toml-reader 1
hledger-web 1
pandoc 1
keter 1
bzlib 1
bz2 1
bzlib-conduit 1
process 1
cryptonite 1
crypton 1
xz-clib 1
spacecookie 1
x509-store 1
crypton-x509-store 1
cmark-gfm 1
Cabal 1
text-iso8601 1
crypton-x509-validation 1
crypton-x509 1
x509 1
jwt 1
warp 1
2 results · Clear filters · Feed
-
High 7.5
S3 and Glacier remotes creds embedded in the git repo were not encrypted
git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybrid, the embedded AWS credentials were stored in the git repository in (effectively) plaintext, not encrypted as they wer…
-
High 8.7
XZ has a heap-use-after-free bug in threaded .xz decoder
XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after fre…