Private key leak via inherited file descriptor

{
  "affected": [
    {
      "database_specific": {
        "human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2025/HSEC-2025-0006.md",
        "osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2025/HSEC-2025-0006.json"
      },
      "package": {
        "ecosystem": "Hackage",
        "name": "x509-store"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "type": "CVSS_V3"
        }
      ]
    },
    {
      "database_specific": {
        "human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2025/HSEC-2025-0006.md",
        "osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2025/HSEC-2025-0006.json"
      },
      "package": {
        "ecosystem": "Hackage",
        "name": "crypton-x509-store"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.6.9"
            },
            {
              "fixed": "1.6.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "database_specific": {
    "home": "https://github.com/haskell/security-advisories",
    "osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export",
    "repository": "https://github.com/haskell/security-advisories"
  },
  "details": "# Private key leak via inherited file descriptor\n\nThe X.509 key reading function `readKeyFile` opened a file\ndescriptor to the private key without setting the *close-on-exec*\nflag. If a child process is `exec`ed at the same time, it would\ninherit that file descriptor and could read the private key\nmaterial.\n\nImpact is limited to child processes that run untrusted code, but\nthat do not close inherited file descriptors. (For example, the\n`su(1)` command.)\n\nThis leak was fixed by setting the *close-on-exec* flag on\nunix-based systems.\n",
  "id": "HSEC-2025-0006",
  "modified": "2025-11-17T02:22:38Z",
  "published": "2025-11-17T02:22:38Z",
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/kazu-yamamoto/crypton-certificate/commit/e353d450c381c9d6b903c4257927e0c89c97acb1"
    }
  ],
  "schema_version": "1.5.0",
  "summary": "Private key leak via inherited file descriptor"
}