File standard libary/core vulns (closes RustSec/cargo-audit#46) #146
Conversation
rust/std/CVE-2018-1000810.toml
Outdated
| patched_versions = [">= 1.29.1"] | ||
| unaffected_versions = ["< 1.26.0"] | ||
| url = "https://groups.google.com/forum/#!topic/rustlang-security-announcements/CmSuTm-SaU0" | ||
| categories = ["dos"] |
There was a problem hiding this comment.
This is not just a DoS, it's a heap buffer overflow write
There was a problem hiding this comment.
I originally added rce before noticing it's local-only(?), and the current coarse-grained categorization doesn't have a proper category to capture that:
https://github.com/RustSec/rustsec-crate/blob/master/src/advisory/category.rs#L48
But it hasn't shipped yet, so perhaps it should be broadened from rce to the more general (and less jargony) code-execution
|
I do not see much value in doing this until we have a story around consuming these. Right now all it would do is require us to manually duplicate Rust CVEs in here and show them on rustsec.org. That sounds like we're signing up for manual work with little or no gain. |
|
@Shnatsel next step to me is to consume them in the database, but it's a chicken and egg problem writing the code to consume them if they're not in the database to begin with. My first thought when I actually found the extended descriptions of each vuln was "Wow, that was actually kind of hard to find..." |
|
Another couple thoughts on this:
|
Files vulnerabilities in the standard library originally reported at: https://groups.google.com/forum/#!forum/rustlang-security-announcements Or otherwise collected at: rustsec/rustsec#46 The `rustsec` crate doesn't presently consume these, but I'd like to add support ASAP.
tarcieri
force-pushed
the
rust-lang-vulns
branch
from
19f08c2 to
58db1ee
Compare
|
Merging this with the initial goals of being able to load these in the I think these are low volume and low effort to import to the point that they won't cause undue burden. |
|
These are now rendered on https://rustsec.org (which is, I think, the only place the original markdown for these advisories is rendered online?):
|
Files vulnerabilities in the standard library originally reported at:
https://groups.google.com/forum/#!forum/rustlang-security-announcements
Or otherwise collected at:
rustsec/rustsec#46
The
rustseccrate doesn't presently consume these, but I'd like to addsupport ASAP.