Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Upgrade regex dependency #1874

Closed
martin-g opened this issue Jun 14, 2022 · 1 comment · Fixed by #1875
Closed

Upgrade regex dependency #1874

martin-g opened this issue Jun 14, 2022 · 1 comment · Fixed by #1875
Labels
arrow Changes to the arrow crate bug security

Comments

@martin-g
Copy link
Member

Describe the bug

Arrow currently uses regex = 1.3:

arrow-rs/arrow/Cargo.toml

Line 49 in cedaf8a

regex = "1.3"

There is a security vulnerability in all versions older than 1.5.4 - https://blog.rust-lang.org/2022/03/08/cve-2022-24713.html

To Reproduce

N/A

Expected behavior

Use a version that is not vulnerable

Additional context

N/A
@martin-g martin-g added the bug label Jun 14, 2022
@martin-g
Copy link
Member Author

PR is coming!

martin-g added a commit to martin-g/arrow-rs that referenced this issue Jun 14, 2022
@martin-g
Fixes apache#1874 - Upgrade regex dependency to 1.5.6
413f393 
Signed-off-by: Martin Tzvetanov Grigorov <mgrigorov@apache.org>
@martin-g martin-g mentioned this issue Jun 14, 2022
Merged
tustvold pushed a commit that referenced this issue Jun 14, 2022
@martin-g
Fixes #1874 - Upgrade regex dependency to 1.5.6 (#1875)
5683ee9 
Signed-off-by: Martin Tzvetanov Grigorov <mgrigorov@apache.org>
@alamb alamb changed the title Upgrade regex dependency to latest Upgrade regex dependency Jun 23, 2022
@alamb alamb added arrow Changes to the arrow crate security labels Jun 23, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
arrow Changes to the arrow crate bug security
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fixes #1874 - Upgrade regex dependency to 1.5.6 martin-g/arrow-rs
2 participants
@martin-g @alamb