Security vulnerability on dependency libsecp256k1

[emmanuelm41]

Issue summary
Today some vulnerability was discovered on one of the crate the lib uses. This is the link to that issue. Now, when an app runs cargo audit it fails as this new bug was discovered. If you try to update it, the building process fails.

Other information and links
Cargo audit partial output:

Crate:         libsecp256k1
Version:       0.3.5
Title:         libsecp256k1 allows overflowing signatures
Date:          2021-07-13
ID:            RUSTSEC-2021-0076
URL:           https://rustsec.org/advisories/RUSTSEC-2021-0076
Solution:      Upgrade to >=0.5.0

[cryptoquick]

We believe this issue might be solved by upgrading libp2p. We'd like to take care of that before addressing this directly, since that might take care of it.

[rllola]

@cryptoquick I think you need to upgrade libsecp256k1 to 0.5.0 or 0.6.0.

see https://github.com/ChainSafe/forest/blob/main/crypto/Cargo.toml#L16

[cryptoquick]

Heh, unfortunately, it's not quite that simple. @rllola I should rephrase, we need to update libp2p before this issue can be solved, since it also depends on the older version of the crate. So it's not quite that simple. However, I got work started towards this issue in #1202.

[rllola]

Hi @q9f
We are happy to see this issue closed. Are you planning to release those changes soon ?

[ec2]

Yes. We can release these crates next week.