haskell / haskell/security-advisories

Abandoned vincenthz packages

Open
#187 10 comments 5 reactions 0 assignees View on GitHub
Dominant language
Haskell
Stars
64
Forks
27
Avg merge
3h 39m
Merged PRs (30d)
1

Description

Mandatory information:

* Package : I think the most notable are `memory`, `foundation`, `basement`
* cvss: 8
* affected versions: Latest, and given that the packages are abandoned, no new release will ever happen.

Long description:

The packages by Vincent have been abandoned with known issues. Given that these packages are commonly used in networked applications, I think it would be prudent to use official communication channels to note that these packages have serious unpatched issues, some of which may already be triggerable from the network.

For example, here is an infinite loop discovered by GHC devs, which was identified and never addressed. The repo is now archived so the issue will presumably never get fixed: https://github.com/haskell-foundation/foundation/pull/570

Neil Mitchell pointed out another issue: https://github.com/haskell-foundation/foundation/issues/447

Contributor guide

Open the contributing guide

Research direction

Review the referenced foundation pull request #570 and issue #447, then read this issue's comment thread to understand the unresolved concerns. Determine whether the official security-advisory process can address the abandoned packages; done means an agreed communication outcome is published or the request is formally resolved.

Written by the indexing model from the issue text.

Assessment

Tech stack
haskell
Domain
security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.