Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update to nix 0.20.2 #58

Closed
bjax15 opened this issue Oct 18, 2021 · 2 comments · Fixed by #59
Closed

Update to nix 0.20.2 #58

bjax15 opened this issue Oct 18, 2021 · 2 comments · Fixed by #59
Labels
bug Something isn't working needs-review

Comments

@bjax15
Copy link

bjax15 commented Oct 18, 2021

Describe the bug
A vulnerability has been reported to RustSec for the nix 0.20.0 crate. The affected function doesn't look to be used in this crate, however, using cargo audit will trip on the 0.20.0 dependency nonetheless.

Expected behavior
Running cargo audit without error.

Additional context
RustSec entry:

Crate:         nix
Version:       0.20.0
Title:         Out-of-bounds write in nix::unistd::getgrouplist
Date:          2021-09-27
ID:            RUSTSEC-2021-0119
URL:           https://rustsec.org/advisories/RUSTSEC-2021-0119
Solution:      Upgrade to ^0.20.2 OR ^0.21.2 OR ^0.22.2 OR >=0.23.0
@bjax15 bjax15 added bug Something isn't working needs-review labels Oct 18, 2021
@Tim-Zhang
Copy link
Member

As a library we don't have a Cargo.lock in our repo so that users can upgrade the nix version by themselves.

jmagnuson added a commit to jmagnuson/cgroups-rs that referenced this issue Oct 29, 2021
@jmagnuson
deps: update nix to 0.20.2
88b7aaf 
Enforces use of a version of nix which contains a patch for
RUSTSEC-2021-0119.

Fixes kata-containers#58

Signed-off-by: Jon Magnuson <jon.magnuson@gmail.com>
@jmagnuson jmagnuson mentioned this issue Oct 29, 2021
Merged
@Tim-Zhang
Copy link
Member

ah, it makes sense if the major number is different.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working needs-review
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

deps: update nix to 0.20.2 jmagnuson/cgroups-rs
2 participants
@Tim-Zhang @bjax15