HSEC-2025-0006 json
Private key leak via inherited file descriptor
published 11mo ago modified 11mo ago
- cvss
- 5.3
- version 3.1, OSV
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
# Private key leak via inherited file descriptor
The X.509 key reading function `readKeyFile` opened a file descriptor to the private key without setting the *close-on-exec* flag. If a child process is `exec`ed at the same time, it would inherit that file descriptor and could read the private key material.
Impact is limited to child processes that run untrusted code, but that do not close inherited file descriptors. (For example, the `su(1)` command.)
This leak was fixed by setting the *close-on-exec* flag on unix-based systems.
Patch / fix
Is HSEC-2025-0006 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| OSV | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| hackage | x509-store | >=0.1 |
no fix listed |
| hackage | crypton-x509-store | >=1.6.9, <1.6.12 |
1.6.12 |
References
Sources
- OSV HSEC-2025-0006
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.