RUSTSEC-2020-0146: arr! macro erases lifetimes

[github-actions]

arr! macro erases lifetimes

Details
Package	generic-array
Version	0.12.3
URL	fizyk20/generic-array#98
Date	2020-04-09
Patched versions	>=0.14.0
Unaffected versions	<0.8.0

Affected versions of this crate allowed unsoundly extending
lifetimes using arr! macro. This may result in a variety of
memory corruption scenarios, most likely use-after-free.

See advisory page for additional details.

[delta1]

Tracked this down to tari-crypto dep on blake2 > crypto-mac > generic-array

Will make an issue in tari-crypto

cargo tree

│   ├── tari_crypto v0.8.2
│   │   ├── blake2 v0.8.1
│   │   │   ├── byte-tools v0.3.1
│   │   │   ├── crypto-mac v0.7.0
│   │   │   │   ├── generic-array v0.12.3

[mbrubeck]

A patched version generic-array 0.12.4 is now available, so you can fix this without any changes to tari_crypto, by running:

cargo update -p generic-array:0.12.3

[delta1]

Thanks @mbrubeck will give that a shot