Haskell 安全公告数据库

Haskell 安全公告数据库是一个针对通过 Hackage 发布的软件包提交的安全公告仓库。

该数据库尚属新近建立。如果您开发了使用其信息的工具或数据库， 请提交一个 PR 在此处列出。

报告漏洞

要报告一个新漏洞，请使用以下模板提交一个 pull request。 更多信息请参阅 CONTRIBUTING.md。

公告格式

请参阅 EXAMPLE_ADVISORY.md 获取模板。

公告采用 Markdown 格式，并包含机器可读的 TOML “front matter”。

以下是公告中 TOML “front matter” 部分的模式。如果您基于此说明而非 EXAMPLE_ADVISORY.md 来编写您的公告，请记住 删除每个字段的解释性注释。

[advisory]
# Identifier for the advisory (mandatory). Will be assigned a "HSEC-YYYY-NNNN"
# identifier e.g. HSEC-2022-0001. Please use "HSEC-0000-0000" in PRs.
# Or run `hsec-tools next-id` to print the next available ID.
id = "HSEC-0000-0000"

# Publication date of the advisory as an RFC 3339 date.
# DO NOT INCLUDE THIS in files committed to Git.
# It will be derived from the Git commit history.
date = 2021-01-31

# Optional: Classification of the advisory with respect to the Common Weakness Enumeration.
cwe = [820]

# Optional: Classification of the advisory with respect to the Common Attack Pattern Enumerations and Classifications.
capec = [123]

# Arbitrary keywords.  We recommend to include keywords relating
# to the protocols, data formats or services pertaining to the
# affected package (e.g. "json", "tls", "aws").  You can also
# include keywords describing the vulnerability or impact (e.g.
# "dos", "sqli" "csrf").  Just think, "what keywords would I use
# if I was searching for issues affecting this package, or a
# particular class of vulnerabilities?"
keywords = ["ssl", "mitm"]

# Vulnerability aliases, e.g. CVE or GHSA IDs.  This field is
# optional, but it is strongly recommended to reference any known
# aliases.
#
# A corresponding CVE is not required, but you can request one if
# you want: https://iwantacve.org/
#
#aliases = ["CVE-2018-XXXX"]

# Related vulnerabilities (optional)
# e.g. CVE for a C library wrapped by a Haskell library
#related = ["CVE-2018-YYYY", "CVE-2018-ZZZZ"]

# References to articles, issues/PRs, etc.  Recognised types:
# ADVISORY, ARTICLE, DETECTION, DISCUSSION, REPORT,
# FIX, INTRODUCED, PACKAGE, EVIDENCE, WEB
[[references]]
type = "REPORT"
url = "https://github.com/username/package/issues/123"
[[references]]
type = "FIX"
url = "https://github.com/username/package/pull/139"

# Affected package(s).  You can declare one or more packages.
# Sub-fields are `package`, `cvss`, `arch`, `os`, `declarations`,
# `api` and the `versions` table.
[[affected]]

# Mandatory package component identifier; ONE of the following:
#
# OPTION 1: name of the affected package on Hackage
package = "acme-broken"
#
# OPTION 2: component of GHC compiler suite
# ghc-component = {ghc,ghci,rts,ghc-pkg,runghc,ghc-iserv,hp2ps,hpc,hsc2hs,haddock}

# Mandatory: a Common Vulnerability Scoring System score. More information
# can be found on the CVSS website, https://www.first.org/cvss/.
# The committee will assist advisory authors in constructing an appropriate CVSS if necessary.
cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"

# Optional: CPU architectures impacted by this vulnerability
# Only use this if the vulnerability is specific to a particular CPU architecture,
# e.g. the vulnerability is in x86 assembly.
# For a list of CPU architecture strings, see the documentation for System.Info.arch:
# <https://hackage.haskell.org/package/base-4.16.1.0/docs/System-Info.html>
#arch = ["x86", "x86_64"]

# Optional: Operating systems impacted by this vulnerability
# Only use this if the vulnerable is specific to a particular OS, e.g. it was
# located in a binding to a Windows-specific API.
# For a list of OS strings, see the documentation for System.Info.os:
# <https://hackage.haskell.org/package/base-4.16.1.0/docs/System-Info.html>
#os = ["mingw32"]

# Optional: Table of canonical paths to vulnerable declarations in the package
# that describes which versions impacted by this advisory used that particular
# name (e.g. if an affected function or datatype was renamed between versions).
# The path syntax is the module import path, without any type signatures or
# additional information, followed by the affected versions.
#declarations = { "Acme.Broken.function" = ">= 1.1.0 && < 1.2.0", "Acme.Broken.renamedFunction" = ">= 1.2.0 && < 1.2.0.5"}

# Optional: Specific vulnerable APIs (functions, types, etc.) affected by
# this advisory. Each entry identifies a module and name within the package.
#[[affected.api]]
#module = "Acme.Broken"
#name = "vulnerableFunction"

# Versions affected by the vulnerability.
#
# The `fixed` field is optional.  You can specify multiple ranges
# (for example, if the issue was introduced in multiple releases
# series).  In the case of multiple ranges, use `fixed` to "close"
# a range, even when the release series does not actually have a
# fix.  For example, if an issue was introduced in 1.0.8 and 1.1.2
# (but 1.1 is unaffected), and a fix has not been released for the
# 1.0.x series, specify:
[[affected.versions]]
introduced = "1.0.8"
fixed = "1.1"
[[affected.versions]]
introduced = "1.1.2"

上述 TOML "front matter" 之后是 Markdown 格式的长描述。

Current Members

请参阅 Current members。

Processes

请参阅 Contributing 以获取详细信息。

Acknowledgments

本仓库中的流程和文档基于 RustSec 团队的工作。

License

本仓库中的所有安全公告内容均置于公有领域，包括元数据、描述和示例代码。

code 子目录的内容，其中包含用于在 Haskell 中处理建议数据格式的工具和库，采用三条款 BSD 许可证授权。详情请参阅 该子目录的 LICENSE 文件。