hsec-2025-0006
osv_haskell
Description
# Private key leak via inherited file descriptor The X.509 key reading function `readKeyFile` opened a file descriptor to the private key without setting the *close-on-exec* flag. If a child process is `exec`ed at the same time, it would inherit that file descriptor and could read the private key material. Impact is limited to child processes that run untrusted code, but that do not close inherited file descriptors. (For example, the `su(1)` command.) This leak was fixed by setting the *close-on-exec* flag on unix-based systems.
Timeline
- Published
- unknown
- Last Modified
- unknown
CVSS Details
CVSS details not available.
Affected Products
No product information available.
References
Linked Vulnerabilities
No linked vulnerabilities found.
{
"affected": [
{
"database_specific": {
"human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2025/HSEC-2025-0006.md",
"osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2025/HSEC-2025-0006.json",
"source": "https://github.com/haskell/security-advisories/blob/generated/osv-export/2025/HSEC-2025-0006.json"
},
"package": {
"ecosystem": "Hackage",
"name": "x509-store",
"purl": "pkg:hackage/x509-store"
},
"ranges": [
{
"events": [
{
"introduced": "0.1"
}
],
"type": "ECOSYSTEM"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"versions": [
"1.4.0",
"1.4.1",
"1.4.2",
"1.4.3",
"1.4.4",
"1.5.0",
"1.6.0",
"1.6.1",
"1.6.2",
"1.6.3",
"1.6.4",
"1.6.5",
"1.6.6",
"1.6.7",
"1.6.8",
"1.6.9"
]
},
{
"database_specific": {
"human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2025/HSEC-2025-0006.md",
"osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2025/HSEC-2025-0006.json",
"source": "https://github.com/haskell/security-advisories/blob/generated/osv-export/2025/HSEC-2025-0006.json"
},
"package": {
"ecosystem": "Hackage",
"name": "crypton-x509-store",
"purl": "pkg:hackage/crypton-x509-store"
},
"ranges": [
{
"events": [
{
"introduced": "1.6.9"
},
{
"fixed": "1.6.12"
}
],
"type": "ECOSYSTEM"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"versions": [
"1.6.10",
"1.6.11",
"1.6.9"
]
}
],
"database_specific": {
"home": "https://github.com/haskell/security-advisories",
"osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export",
"repository": "https://github.com/haskell/security-advisories"
},
"details": "# Private key leak via inherited file descriptor\n\nThe X.509 key reading function `readKeyFile` opened a file\ndescriptor to the private key without setting the *close-on-exec*\nflag. If a child process is `exec`ed at the same time, it would\ninherit that file descriptor and could read the private key\nmaterial.\n\nImpact is limited to child processes that run untrusted code, but\nthat do not close inherited file descriptors. (For example, the\n`su(1)` command.)\n\nThis leak was fixed by setting the *close-on-exec* flag on\nunix-based systems.\n",
"id": "HSEC-2025-0006",
"modified": "2025-11-17T02:27:23.133734Z",
"published": "2025-11-17T02:22:38Z",
"references": [
{
"type": "FIX",
"url": "https://github.com/kazu-yamamoto/crypton-certificate/commit/e353d450c381c9d6b903c4257927e0c89c97acb1"
}
],
"schema_version": "1.7.5",
"summary": "Private key leak via inherited file descriptor"
}