HSEC-2023-0006
See a problem?- Import Source
- https://github.com/haskell/security-advisories/blob/generated/osv-export/2023/HSEC-2023-0006.json
- JSON Data
- https://api.osv.dev/v1/vulns/HSEC-2023-0006
- Published
- 2023-07-19T13:59:54Z
- Modified
- 2023-12-13T13:05:32.474017Z
- Summary
- x509-validation does not enforce pathLenConstraint
- Details
-
x509-validation does not enforce pathLenConstraint
x509-validation prior to version 1.4.8 did not enforce the pathLenConstraint value. Constrained CAs could accidentally (or deliberately) issue CAs below the maximum depth and x509-validation would accept certificates issued by the unauthorised intermediate CAs.
- References
Affected packages
Hackage / x509-validation
Package
- Name
- x509-validation
- Purl
- pkg:hackage/x509-validation
Severity
- 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N CVSS Calculator