OSEC-2023-01

See a problem?
Import Source
https://github.com/ocaml/security-advisories/blob/generated-osv/2023/OSEC-2023-01.json
JSON Data
https://api.osv.dev/v1/vulns/OSEC-2023-01
Published
2023-05-25T12:00:00Z
Modified
2026-01-09T12:00:00Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Time of check time of use issue in opam's cache
Details

Bug description

Opam uses since version 2.0.0 a download cache: if a source artifact is needed, first its hash is looked up in the local cache (~/.opam/download-cache/<hash-algorihm>/<hash>). Opam supports multiple hash algorithms, a cache lookup tries all hash algorithms present in the opam file. Before opam 2.1.5, the hash of a cache entry as encoded in its file name was trusted and not checked against its content.

If a package specifies only a single (non-weak) hash algorithm, this lead to the source artifact taken as is, any error while writing the artifact into the cache, or reading it from the cache, was not detected. Also, in certain setups, if the download cache is shared (writable) across containers (for example in some CI systems), this leads to the possibility of cache poisoning.

Thanks to Raja and Kate, the issue was fixed in PR 5538

Timeline

The timeline of this issue is as follows:

  • Feb 23rd 2023 conducted black-box security audit of opam
  • Feb 24th 2023 reported to the opam team
  • Feb 27th 2023 video meeting with the opam team, explaining the issue further
  • Mar 27th 2023 initial review meeting of the patches developed by the opam team
  • May 9th 2023 public PR fixing the issue discovered
  • May 25th 2023 release of opam 2.1.5
Database specific 
{
    "osv": "https://github.com/ocaml/security-advisories/tree/generated-osv/2023/OSEC-2023-01.json",
    "human_link": "https://github.com/ocaml/security-advisories/tree/main/advisories/2023/OSEC-2023-01.md",
    "cwe": [
        "CWE-354"
    ]
}
References
Credits
    • Reynir Björnsson - REPORTER
    • Hannes Mehnert - REPORTER
    • Kate - REMEDIATION_DEVELOPER
    • Raja Boujbel - REMEDIATION_REVIEWER

Affected packages

opam / opam-repository

Package

Name
opam-repository
Purl
pkg:opam/opam-repository

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2
Fixed
2.1.5
Type
GIT
Repo
https://github.com/ocaml/opam
Events
Fixed
7a538fd0bf3b3956d84bb25d0f6b1126fa177595
Introduced
cfa4e77b49d0bccaf5c91b2e6f36089aab5e0540

Affected versions

2.*
2.0~alpha5
2.0.0~beta
2.0.0~beta3
2.0.0~beta3.1
2.0.0~beta5
2.0.0~rc
2.0.0~rc2
2.0.0~rc3
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.0.10
2.1.0~beta2
2.1.0~beta4
2.1.0~rc
2.1.0~rc2
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4

Ecosystem specific 

{
    "opam_constraint": "opam-repository {>= \"2\" & < \"2.1.5\"}"
}

Database specific

source 
"https://github.com/ocaml/security-advisories/blob/generated-osv/2023/OSEC-2023-01.json"