hsec-2024-0009
osv_haskell
Description
# Public key confusion in third-party blocks Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a `ThirdPartyBlock` request can be sent, providing only the necessary info to generate a third-party block and to sign it: - the public key of the previous block (used in the signature); - the public keys part of the token symbol table (for public key interning in datalog expressions). A third-party block request forged by a malicious user can trick the third-party authority into generating datalog trusting the wrong keypair.
Timeline
- Published
- unknown
- Last Modified
- unknown
CVSS Details
CVSS details not available.
Affected Products
No product information available.
References
Linked Vulnerabilities
No linked vulnerabilities found.
{
"affected": [
{
"database_specific": {
"human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2024/HSEC-2024-0009.md",
"osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2024/HSEC-2024-0009.json",
"source": "https://github.com/haskell/security-advisories/blob/generated/osv-export/2024/HSEC-2024-0009.json"
},
"package": {
"ecosystem": "Hackage",
"name": "biscuit-haskell",
"purl": "pkg:hackage/biscuit-haskell"
},
"ranges": [
{
"events": [
{
"introduced": "0.3.0.0"
},
{
"fixed": "0.4.0.0"
}
],
"type": "ECOSYSTEM"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"versions": [
"0.3.0.0",
"0.3.0.1"
]
}
],
"aliases": [
"CVE-2024-41949",
"CVE-2024-42350",
"GHSA-47cq-pc2v-3rmp",
"GHSA-p9w4-585h-g3c7",
"GHSA-rgqv-mwc3-c78m"
],
"database_specific": {
"home": "https://github.com/haskell/security-advisories",
"osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export",
"repository": "https://github.com/haskell/security-advisories"
},
"details": "# Public key confusion in third-party blocks\n\nThird-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a `ThirdPartyBlock` request can be sent, providing only the necessary info to generate a third-party block and to sign it:\n\n- the public key of the previous block (used in the signature);\n- the public keys part of the token symbol table (for public key interning in datalog expressions).\n\nA third-party block request forged by a malicious user can trick the third-party authority into generating datalog trusting the wrong keypair.\n",
"id": "HSEC-2024-0009",
"modified": "2025-11-14T18:15:43.110342Z",
"published": "2025-11-14T14:45:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/biscuit-auth/biscuit-haskell/security/advisories/GHSA-47cq-pc2v-3rmp"
},
{
"type": "FIX",
"url": "https://github.com/biscuit-auth/biscuit-haskell/pull/93"
}
],
"schema_version": "1.7.5",
"summary": "Public key confusion in third-party blocks"
}