haskell / haskell/security-advisories
Abandoned vincenthz packages
- Dominant language
- Haskell
- Stars
- 64
- Forks
- 27
- Avg merge
- 3h 39m
- Merged PRs (30d)
- 1
Description
Mandatory information:
* Package : I think the most notable are `memory`, `foundation`, `basement`
* cvss: 8
* affected versions: Latest, and given that the packages are abandoned, no new release will ever happen.
Long description:
The packages by Vincent have been abandoned with known issues. Given that these packages are commonly used in networked applications, I think it would be prudent to use official communication channels to note that these packages have serious unpatched issues, some of which may already be triggerable from the network.
For example, here is an infinite loop discovered by GHC devs, which was identified and never addressed. The repo is now archived so the issue will presumably never get fixed: https://github.com/haskell-foundation/foundation/pull/570
Neil Mitchell pointed out another issue: https://github.com/haskell-foundation/foundation/issues/447
Contributor guide
Research direction
Review the referenced foundation pull request #570 and issue #447, then read this issue's comment thread to understand the unresolved concerns. Determine whether the official security-advisory process can address the abandoned packages; done means an agreed communication outcome is published or the request is formally resolved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- haskell
- Domain
- security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100