Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package ghc-aeson for openSUSE:Factory checked in at 2026-11-06 19:48:09 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/ghc-aeson (Old) and /work/SRC/openSUSE:Factory/.ghc-aeson.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ghc-aeson" Fri Nov 6 19:48:09 2026 rev:51 rq:1395507 version:2.2.5.1 Changes: -------- --- /work/SRC/openSUSE:Factory/ghc-aeson/ghc-aeson.changes 2026-06-10 15:57:58.012686675 +0200 +++ /work/SRC/openSUSE:Factory/.ghc-aeson.new.3759290/ghc-aeson.changes 2026-11-06 19:54:17.162910427 +0100 @@ -1,0 +2,9 @@ +Sat Aug 29 13:20:56 UTC 2026 - Peter Simons <[email protected]> + +- Update aeson to version 2.2.5.1. + Upstream has edited the change log file since the last release in + a non-trivial way, i.e. they did more than just add a new entry + at the top. You can review the file at: + http://hackage.haskell.org/package/aeson-2.2.5.1/src/changelog.md + +------------------------------------------------------------------- Old: ---- aeson-2.2.5.0.tar.gz New: ---- aeson-2.2.5.1.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ghc-aeson.spec ++++++ --- /var/tmp/diff_new_pack.TGMIIl/_old 2026-11-06 19:54:18.284957408 +0100 +++ /var/tmp/diff_new_pack.TGMIIl/_new 2026-11-06 19:54:18.286957492 +0100 @@ -20,7 +20,7 @@ %global pkgver %{pkg_name}-%{version} %bcond_with tests Name: ghc-%{pkg_name} -Version: 2.2.5.0 +Version: 2.2.5.1 Release: 0 Summary: Fast JSON parsing and encoding License: BSD-3-Clause ++++++ aeson-2.2.5.0.tar.gz -> aeson-2.2.5.1.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aeson-2.2.5.0/aeson.cabal new/aeson-2.2.5.1/aeson.cabal --- old/aeson-2.2.5.0/aeson.cabal 2001-09-09 03:46:40.000000000 +0200 +++ new/aeson-2.2.5.1/aeson.cabal 2001-09-09 03:46:40.000000000 +0200 @@ -1,6 +1,6 @@ cabal-version: 2.2 name: aeson -version: 2.2.5.0 +version: 2.2.5.1 license: BSD-3-Clause license-file: LICENSE category: Text, Web, JSON diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aeson-2.2.5.0/changelog.md new/aeson-2.2.5.1/changelog.md --- old/aeson-2.2.5.0/changelog.md 2001-09-09 03:46:40.000000000 +0200 +++ new/aeson-2.2.5.1/changelog.md 2001-09-09 03:46:40.000000000 +0200 @@ -1,5 +1,16 @@ For the latest version of this document, please see [https://github.com/haskell/aeson/blob/master/changelog.md](https://github.com/haskell/aeson/blob/master/changelog.md). +### 2.2.5.1 - 2026-08-29 + +Fix a DoS vulnerability caused by parsing large numbers (advisory [HSEC-2026-0007](https://haskell.github.io/security-advisories/advisory/HSEC-2026-0007.html)). Backported from 2.3.0.0 to ease migration. + +* Fix parsing of fractional numbers to reject exponents smaller than -1024. + This change affects `FromJSON` instances of `Fixed`, `DiffTime`, and `NominalDiffTime`, + rejecting more inputs. Error messages for `Ratio` and integral types are also slightly different + due to reusing the same bounding logic. +* In `text-iso8601-0.1.1.2`: + - Reject years of more than 15 digits. + ### 2.2.5.0 * Support `semialign-1.4` @@ -34,7 +45,7 @@ One gotcha is that internal `Text` values (in `Key`s or `Value` `String`s) will most likely retain the original input `Text` value (its underlying `Array`). It shouldn't be an issue if the `Value` is then decoded to something else so these - `Text` values disapper, but if not (e.g. `Object` keys survive) + `Text` values disappear, but if not (e.g. `Object` keys survive) then users might want to use `Data.Text.copy`. ### 2.2.0.0 @@ -54,7 +65,7 @@ In addition to `Maybe` (and `Option`) fields the `Data.Monoid.First` and `Data.Monoid.Last` are also omitted, as well as the most newtype wrappers, when their wrap omittable type (e.g. newtypes in `Data.Monoid` and `Data.Semigroup`, `Identity`, `Const`, `Tagged`, `Compose`). - Additionall "boring" types like `()` and `Proxy` are omitted as well. + Additionally "boring" types like `()` and `Proxy` are omitted as well. As the omitting is now uniform, type arguments are also omitted (also in `Generic1` derived instance). Resolves issues: @@ -72,7 +83,7 @@ * Move `Data.Aeson.Parser` module into separate [`attoparsec-aeson`](https://hackage.haskell.org/package/attoparsec-aeson) package, as these parsers are not used by `aeson` itself anymore. * Use [`text-iso8601`](https://hackage.haskell.org/package/text-iso8601) package for parsing `time` types. These are slightly faster than previously used (copy of) `attoparsec-iso8601`. Formats accepted is slightly changed: - - The space between time and timezone offset (in `UTCTime` and `ZonedTime`) is disallowed. ISO8601 explictly forbidds it. + - The space between time and timezone offset (in `UTCTime` and `ZonedTime`) is disallowed. ISO8601 explicitly forbids it. - The timezone offsets can be in range -23:59..23:59. This is how Python, joda-time etc seems to do. (Previously the range was -12..+14) * Remove internal `Data.Aeson.Internal` and `Data.Aeson.Internal.Time` modules. Everything from the former is exported elsewhere (`Data.Aeson.Types`), the latter was truly internal. @@ -235,7 +246,7 @@ parseJSON = gParseJSON defaultOptions { rejectUnknownFields = True } ``` -* `FromJSON` instance of `Ratio a` now parses numbers in addtion to +* `FromJSON` instance of `Ratio a` now parses numbers in addition to standard `{numerator=..., denumerator=...}` encoding. Thanks to Aleksey Khudyakov. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aeson-2.2.5.0/src/Data/Aeson/Types/FromJSON.hs new/aeson-2.2.5.1/src/Data/Aeson/Types/FromJSON.hs --- old/aeson-2.2.5.0/src/Data/Aeson/Types/FromJSON.hs 2001-09-09 03:46:40.000000000 +0200 +++ new/aeson-2.2.5.1/src/Data/Aeson/Types/FromJSON.hs 2001-09-09 03:46:40.000000000 +0200 @@ -796,11 +796,13 @@ withBoundedScientific_ :: (Parser a -> Parser a) -> (Scientific -> Parser a) -> Value -> Parser a withBoundedScientific_ whenFail f (Number scientific) = if exp10 > 1024 - then whenFail (fail msg) + then whenFail (fail (msg "greater than 1024")) + else if exp10 < -1024 + then whenFail (fail (msg "less than -1024")) else f scientific where exp10 = base10Exponent scientific - msg = "found a number with exponent " ++ show exp10 ++ ", but it must not be greater than 1024" + msg req = "found a number with exponent " ++ show exp10 ++ ", but it must not be " ++ req withBoundedScientific_ whenFail _ v = whenFail (typeMismatch "Number" v) @@ -1706,14 +1708,7 @@ _ -> Scientific.toRealFloat <$> parseScientificText t instance (FromJSON a, Integral a) => FromJSON (Ratio a) where - parseJSON (Number x) - | exp10 <= 1024 - , exp10 >= -1024 = return $! realToFrac x - | otherwise = prependContext "Ratio" $ fail msg - where - exp10 = base10Exponent x - msg = "found a number with exponent " ++ show exp10 - ++ ", but it must not be greater than 1024 or less than -1024" + parseJSON n@(Number _) = withBoundedScientific "Ratio" (($!) pure . realToFrac) n parseJSON o = objParser o where objParser = withObject "Rational" $ \obj -> do diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aeson-2.2.5.0/tests/UnitTests.hs new/aeson-2.2.5.1/tests/UnitTests.hs --- old/aeson-2.2.5.0/tests/UnitTests.hs 2001-09-09 03:46:40.000000000 +0200 +++ new/aeson-2.2.5.1/tests/UnitTests.hs 2001-09-09 03:46:40.000000000 +0200 @@ -38,6 +38,7 @@ , Value(..), camelTo, camelTo2 , defaultOptions, formatPath, formatRelativePath, omitNothingFields, parse) import Data.Char (toUpper, GeneralCategory(Control,Surrogate), generalCategory) +import Data.Fixed (Nano) import Data.HashMap.Strict (HashMap) import Data.Kind (Type) import Data.List (isSuffixOf) @@ -458,17 +459,22 @@ (eitherDecode "1.37" :: Either String Rational) bigRationalDecoding :: Assertion -bigRationalDecoding = - assertEqual "Decoding an Integer with a large exponent should fail" - (Left "Error in $: parsing Ratio failed, found a number with exponent 2000, but it must not be greater than 1024 or less than -1024") +bigRationalDecoding = do + assertEqual "Decoding a Rational with a large exponent should fail" + (Left "Error in $: parsing Ratio failed, found a number with exponent 2000, but it must not be greater than 1024") ((eitherDecode :: L.ByteString -> Either String Rational) "1e2000") - -smallRationalDecoding :: Assertion -smallRationalDecoding = - assertEqual "Decoding an Integer with a large exponent should fail" - (Left "Error in $: parsing Ratio failed, found a number with exponent -2000, but it must not be greater than 1024 or less than -1024") + assertEqual "Decoding a Rational with a small exponent should fail" + (Left "Error in $: parsing Ratio failed, found a number with exponent -2000, but it must not be less than -1024") ((eitherDecode :: L.ByteString -> Either String Rational) "1e-2000") +bigFixedDecoding :: Assertion +bigFixedDecoding = do + assertEqual "Decoding a Fixed with a large exponent should fail" + (Left "Error in $: parsing Fixed failed, found a number with exponent 9999, but it must not be greater than 1024") + ((eitherDecode :: L.ByteString -> Either String Nano) "1e9999") + assertEqual "Decoding a Fixed with a small exponent should fail" + (Left "Error in $: parsing Fixed failed, found a number with exponent -9999, but it must not be less than -1024") + ((eitherDecode :: L.ByteString -> Either String Nano) "1e-9999") bigScientificExponent :: Assertion bigScientificExponent = @@ -555,7 +561,7 @@ , testCase "Ratio with denominator 0" ratioDenominator0 , testCase "Rational parses number" rationalNumber , testCase "Big rational" bigRationalDecoding - , testCase "Small rational" smallRationalDecoding + , testCase "Big fixed" bigFixedDecoding , testCase "Big scientific exponent" bigScientificExponent , testCase "Big integer decoding" bigIntegerDecoding , testCase "Big natural decoding" bigNaturalDecoding
