google-authz icon indicating copy to clipboard operation
google-authz copied to clipboard

Update dependencies to get rid of RUSTSEC-2023-0052

Open mksh opened this issue 2 years ago • 0 comments

webpki package was revealed to contain CPU denial-of-service vulnerability via https://rustsec.org/advisories/RUSTSEC-2023-0052.html

google-authz contains webpki as transitive dependency, cargo audit output:

    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 561 security advisories (from /home/mksh/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (176 crate dependencies)
Crate:     webpki
Version:   0.22.0
Title:     webpki: CPU denial of service in certificate path building
Date:      2023-08-22
ID:        RUSTSEC-2023-0052
URL:       https://rustsec.org/advisories/RUSTSEC-2023-0052
Severity:  7.5 (high)
Solution:  No fixed upgrade is available!
Dependency tree:
webpki 0.22.0
├── webpki-roots 0.22.6
│   ├── tonic 0.7.2
│   │   └── examples 0.1.0
│   └── hyper-rustls 0.23.2
│       └── google-authz 1.0.0-alpha.5
│           └── examples 0.1.0
├── tokio-rustls 0.23.4
│   ├── tonic 0.7.2
│   └── hyper-rustls 0.23.2
└── rustls 0.20.8
    ├── tokio-rustls 0.23.4
    └── hyper-rustls 0.23.2

This updates hyper-rustls dependency of library, and tonic dependency of examples to contain not vulnerable versions

mksh avatar Aug 22 '23 15:08 mksh