google-authz
google-authz copied to clipboard
Update dependencies to get rid of RUSTSEC-2023-0052
webpki package was revealed to contain CPU denial-of-service vulnerability via https://rustsec.org/advisories/RUSTSEC-2023-0052.html
google-authz contains webpki as transitive dependency, cargo audit output:
Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
Loaded 561 security advisories (from /home/mksh/.cargo/advisory-db)
Updating crates.io index
Scanning Cargo.lock for vulnerabilities (176 crate dependencies)
Crate: webpki
Version: 0.22.0
Title: webpki: CPU denial of service in certificate path building
Date: 2023-08-22
ID: RUSTSEC-2023-0052
URL: https://rustsec.org/advisories/RUSTSEC-2023-0052
Severity: 7.5 (high)
Solution: No fixed upgrade is available!
Dependency tree:
webpki 0.22.0
├── webpki-roots 0.22.6
│ ├── tonic 0.7.2
│ │ └── examples 0.1.0
│ └── hyper-rustls 0.23.2
│ └── google-authz 1.0.0-alpha.5
│ └── examples 0.1.0
├── tokio-rustls 0.23.4
│ ├── tonic 0.7.2
│ └── hyper-rustls 0.23.2
└── rustls 0.20.8
├── tokio-rustls 0.23.4
└── hyper-rustls 0.23.2
This updates hyper-rustls dependency of library, and tonic dependency of examples to contain not vulnerable versions