Description
# x509-validation does not enforce pathLenConstraint
*x509-validation* prior to version 1.4.8 did not enforce the
pathLenConstraint value. Constrained CAs could accidentally (or
deliberately) issue CAs below the maximum depth and
*x509-validation* would accept certificates issued by the
unauthorised intermediate CAs.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Hackage | x509-validation | >= 1.4.0, < 1.4.8 | 1.4.8 | HSEC-2023-0006 |