Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

generic-array 0.12 and 0.13 are vulnerable #12

Closed
greyblake opened this issue Mar 1, 2021 · 1 comment
Closed

generic-array 0.12 and 0.13 are vulnerable #12

greyblake opened this issue Mar 1, 2021 · 1 comment

Comments

@greyblake
Copy link

greyblake commented Mar 1, 2021

generic-array v0.12 and v0.13 are vunlerable
See https://rustsec.org/advisories/RUSTSEC-2020-0146

This makes as-slice vulnerable too:

✦ ❯ cargo audit
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 248 security advisories (from /home/sergey/.cargo/advisory-db)
    Updating crates.io index
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (7 crate dependencies)
Crate:         generic-array
Version:       0.12.3
Title:         arr! macro erases lifetimes
Date:          2020-04-09
ID:            RUSTSEC-2020-0146
URL:           https://rustsec.org/advisories/RUSTSEC-2020-0146
Solution:      Upgrade to >=0.14.0
Dependency tree: 
generic-array 0.12.3

Crate:         generic-array
Version:       0.13.2
Title:         arr! macro erases lifetimes
Date:          2020-04-09
ID:            RUSTSEC-2020-0146
URL:           https://rustsec.org/advisories/RUSTSEC-2020-0146
Solution:      Upgrade to >=0.14.0
Dependency tree: 
generic-array 0.13.2

error: 2 vulnerabilities found!

Would you consider releasing a new version with dropped support of the vulnerable versions of generic-array?
(I am not sure what is the best solution to the problem, but just want to point to its existence)

Thank you in advance! <3

UPDATE:
Alternative solution could be, if generic-array will backport the fix to the old versions.
See: fizyk20/generic-array#99

@greyblake
Copy link
Author

I close this because new patched version of generic-array were released that address vulnerability.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant