OSEC-2023-01
Time of check time of use issue in opam's cache
Bug description
Opam uses since version 2.0.0 a download cache: if a source artifact is needed, first its hash is looked up in the local cache (~/.opam/download-cache/<hash-algorihm>/<hash>). Opam supports multiple hash algorithms, a cache lookup tries all hash algorithms present in the opam file. Before opam 2.1.5, the hash of a cache entry as encoded in its file name was trusted and not checked against its content.
If a package specifies only a single (non-weak) hash algorithm, this lead to the source artifact taken as is, any error while writing the artifact into the cache, or reading it from the cache, was not detected. Also, in certain setups, if the download cache is shared (writable) across containers (for example in some CI systems), this leads to the possibility of cache poisoning.
Thanks to Raja and Kate, the issue was fixed in PR 5538
Timeline
The timeline of this issue is as follows:
- Feb 23rd 2023 conducted black-box security audit of opam
- Feb 24th 2023 reported to the opam team
- Feb 27th 2023 video meeting with the opam team, explaining the issue further
- Mar 27th 2023 initial review meeting of the patches developed by the opam team
- May 9th 2023 public PR fixing the issue discovered
- May 25th 2023 release of opam 2.1.5
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
What each source reports
OSV Score used
Time of check time of use issue in opam's cache
Bug description
Opam uses since version 2.0.0 a download cache: if a source artifact is needed, first its hash is looked up in the local cache (~/.opam/download-cache/<hash-algorihm>/<hash>). Opam supports multiple hash algorithms, a cache lookup tries all hash algorithms present in the opam file. Before opam 2.1.5, the hash of a cache entry as encoded in its file name was trusted and not checked against its content.
If a package specifies only a single (non-weak) hash algorithm, this lead to the source artifact taken as is, any error while writing the artifact into the cache, or reading it from the cache, was not detected. Also, in certain setups, if the download cache is shared (writable) across containers (for example in some CI systems), this leads to the possibility of cache poisoning.
Thanks to Raja and Kate, the issue was fixed in PR 5538
Timeline
The timeline of this issue is as follows:
- Feb 23rd 2023 conducted black-box security audit of opam
- Feb 24th 2023 reported to the opam team
- Feb 27th 2023 video meeting with the opam team, explaining the issue further
- Mar 27th 2023 initial review meeting of the patches developed by the opam team
- May 9th 2023 public PR fixing the issue discovered
- May 25th 2023 release of opam 2.1.5
- Record
OSEC-2023-01- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-06
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opam-repositoryopam |
2 up to 2.1.5, plus listed versions 2.0.02.0.0~beta2.0.0~beta32.0.0~beta3.12.0.0~beta5 Show 23 moreShow less2.0.0~rc2.0.0~rc22.0.0~rc32.0.12.0.102.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.92.0~alpha52.1.02.1.0~beta22.1.0~beta42.1.0~rc2.1.0~rc22.1.12.1.22.1.32.1.4 |
2.1.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
OSEC-2023-01 is a high vulnerability (CVSS 7.1) in opam-repository, published May 25, 2023. No source lists public exploit code. Fixed in opam-repository 2.1.5.