File tree Expand file tree Collapse file tree 1 file changed +3
-3
lines changed
advisories/hackage/cabal-install Expand file tree Collapse file tree 1 file changed +3
-3
lines changed Original file line number Diff line number Diff line change @@ -19,7 +19,7 @@ type = "FIX"
19
19
url = " https://github.com/haskell/cabal/commit/dcfdc9cffd74cade4e8cf3df37c5993413ffd30f"
20
20
```
21
21
22
- # Summary
22
+ # cabal-install uses expired key policies
23
23
24
24
A problem was recently discovered in ` cabal-install ` 's
25
25
implementation of the Hackage Security protocol that would allow an
@@ -31,7 +31,7 @@ only a theoretical attack - no keys have been revoked. Release
31
31
contacted distributors of older versions (such as Linux
32
32
distributions) with a patch that they can apply.
33
33
34
- # Background
34
+ ## Background
35
35
36
36
Hackage Security is an implementation of [ The Update Framework] [ ] ,
37
37
which is a design for a package repository that allows untrusted
@@ -79,7 +79,7 @@ malicious or obsolete package index.
79
79
[ key policy file ] : https://hackage.haskell.org/root.json
80
80
[ The Update Framework ] : https://theupdateframework.io/
81
81
82
- # The Issue
82
+ ## The Issue
83
83
84
84
A bug in ` cabal-install ` caused it to skip the verification of the
85
85
key policy file's expiration timestamp. This means that users of
You can’t perform that action at this time.
0 commit comments