Threats tagged 'hackage'

The scientific library version 0.3.9.0 introduced an out-of-bounds read vulnerability in its Eq and Ord implementations for numbers with extreme exponents. This occurs due to integer overflow in exponent calculations leading to negative indexing of a cached power-of-ten array, causing a segmentation fault (SIGSEGV). The issue affects comparisons and arithmetic operations on Scientific values with very large or small exponents. Version 0.3.10.0 fixes the problem by using Integer for logarithm calculations and adding bounds checks.

The scientific library versions prior to 0.3.9.0 had a performance issue in encoding numbers with large coefficients, causing encoding time to be quadratic in the number of digits. This could lead to denial-of-service (DoS) risks in applications that re-encode untrusted JSON numbers, such as proxies or API gateways using aeson. The issue was fixed in version 0.3.9.0 by reimplementing digit extraction to be practically linear, with a recommendation to upgrade to 0.3.10.0 or later to avoid a regression introduced in 0.3.9.0.