BREW-cabal-install-HSEC-2023-0015 — cabal-install uses expired key policies

Affected: Homebrew: cabal-install

# cabal-install uses expired key policies

A problem was recently discovered in `cabal-install`'s implementation of the Hackage Security protocol that would allow an attacker who was in possession of a revoked private key and who could perform a man-in-the-middle attack against Hackage to use the revoked key to deliver malicious packages. At this time, this is only a theoretical attack - no keys have been revoked. Release 3.10.2.0 of `cabal-install` contains a fix for this bug, and we have contacted distributors of older versions (such as Linux distributions) with a patch that they can apply.

## Background

Hackage Security is an implementation of [The Update Framework][], which is a design for a package repository that allows untrusted mirrors without undermining software supply-chain security. In particular, Hackage Security cryptographically guarantees the following properties:

* Mirrors of Hackage cannot change the contents of packages. This prevents the insertion of malicious code.

* Mirrors cannot omit newer packages for more than a few days without clients noticing. This ensures both that mirrors cannot maliciously deny security updates, and that mistakes in their configuration will be noticed.

Hackage has a [key policy file][] that delegates authority to a number of private keys for various purposes. Most of the keys are kept securely offline by trusted community members who annually re-sign the various files to indicate that they still have confide…

Most recent entries from all

BREW-cabal-install-HSEC-2023-0015 — cabal-install uses expired key policies