Remote exploit in aeson

[dhess]

Details: https://cs-syd.eu/posts/2021-09-11-json-vulnerability?source=reddit

Tracked upstream here: haskell/aeson#864

Reddit thread: https://www.reddit.com/r/haskell/comments/pm7rcr/cs_syd_json_vulnerability_in_haskells_aeson/

The vulnerability is via HashMap from https://hackage.haskell.org/package/unordered-containers, which we do not use (directly). We should consider banning the use of unordered-containers, and hashable (https://hackage.haskell.org/package/hashable) until this issue is addressed — if it ever is.

(It's not clear to me whether the maintainers mentioned in the disclosure post, who apparently have known about this issue for ~ 1 year, are the aeson maintainers, or the unordered-containers maintainers, or the hashable maintainers, upon which unordered-containers depends.)

Blocked on:

• Doesn't build with aeson >=2 informatikr/aeson-pretty#36

[dhess]

Supposedly fixed (with some additional configuration required) in Aeson 2.0.1.0: haskell-unordered-containers/unordered-containers#319 (comment)

[georgefst]

Supposedly fixed (with some additional configuration required) in Aeson 2.0.1.0

Seems it was actually fixed in 2.0.0 with a flag, and that flag enabled by default in 2.0.1.

Possibly worth being explicit about configuration anyway, given haskell/aeson#864 (comment):

there is no guarantee it won't be changed again

[brprice]

The stackage tracking issue (commercialhaskell/stackage#6217) may be useful for tracking the community's migration progress.