Identify CVE (Common Vulnerabilities and Exposures) in Iggy

[ryerraguntla]

Background : Late 2020 or Early2021, the entire Enterprise software community went into panic mode due to Log4j vulnerability, resulting in remediating and preventing security issues. This resulted in significant importance to organizing categorizing in CVEs

Managing Common Vulnerabilities and Exposures (CVEs) is a critical security requirement for all enterprise-grade software. This discussion is to find out Iggy's CVEs compliance and document the process to flag and remediate any potential issues. One way to identify CVEs is to have a git pre-merge checks. Below are some of the options. I would like community's thoughts around this topic.

cargo-audit: Automatically audits Cargo.lock file for crates with known security vulnerabilities. It integrates easily into CI/CD workflows via the cargo-audit GitHub Action.

cargo-deny: A highly configurable linter that checks entire dependency graph. In addition to scanning for vulnerabilities, it enforces rules on open-source licenses, bans specific crates, and catches duplicate dependency versions.

cargo-auditable: Embeds the complete dependency tree directly into compiled Rust binaries. This allows production binaries to be scanned for CVEs post-deployment using cargo-audit, even if the source code or lockfile is no longer available..

[ryerraguntla]

Initial audit scan found the below issues.
Let me look into a bit more and create an appropriate GH issue, followed by a fix.

Two useful urls - https://rustsec.org/, https://rustsec.org/advisories/

==========
Crate: crossbeam-epoch
Version: 0.9.18
Title: Invalid pointer dereference in fmt::Pointer impl for Atomic and Shared when the underlying pointer is invalid
Date: 2026-07-06
ID: RUSTSEC-2026-0204
URL: https://rustsec.org/advisories/RUSTSEC-2026-0204
Solution: Upgrade to >=0.9.20

Crate: quick-xml
Version: 0.37.5
Title: Unbounded namespace-declaration allocation in NsReader enables memory-exhaustion denial of service
Date: 2026-06-29
ID: RUSTSEC-2026-0195
URL: https://rustsec.org/advisories/RUSTSEC-2026-0195
Severity: 7.5 (high)
Solution: Upgrade to >=0.41.0

Crate: quick-xml
Version: 0.37.5
Title: Quadratic run time when checking a start tag for duplicate attribute names
Date: 2026-06-29
ID: RUSTSEC-2026-0194
URL: https://rustsec.org/advisories/RUSTSEC-2026-0194
Severity: 7.5 (high)
Solution: Upgrade to >=0.41.0

Crate: quick-xml
Version: 0.38.4
Title: Unbounded namespace-declaration allocation in NsReader enables memory-exhaustion denial of service
Date: 2026-06-29
ID: RUSTSEC-2026-0195
URL: https://rustsec.org/advisories/RUSTSEC-2026-0195
Severity: 7.5 (high)
Solution: Upgrade to >=0.41.0

Crate: quick-xml
Version: 0.38.4
Title: Quadratic run time when checking a start tag for duplicate attribute names
Date: 2026-06-29
ID: RUSTSEC-2026-0194
URL: https://rustsec.org/advisories/RUSTSEC-2026-0194
Severity: 7.5 (high)
Solution: Upgrade to >=0.41.0

Crate: quick-xml
Version: 0.39.4
Title: Unbounded namespace-declaration allocation in NsReader enables memory-exhaustion denial of service
Date: 2026-06-29
ID: RUSTSEC-2026-0195
URL: https://rustsec.org/advisories/RUSTSEC-2026-0195
Severity: 7.5 (high)
Solution: Upgrade to >=0.41.0

Crate: quick-xml
Version: 0.39.4
Title: Quadratic run time when checking a start tag for duplicate attribute names
Date: 2026-06-29
ID: RUSTSEC-2026-0194
URL: https://rustsec.org/advisories/RUSTSEC-2026-0194
Severity: 7.5 (high)
Solution: Upgrade to >=0.41.0

Crate: rsa
Version: 0.9.10
Title: Marvin Attack: potential key recovery through timing sidechannels
Date: 2023-11-22
ID: RUSTSEC-2023-0071
URL: https://rustsec.org/advisories/RUSTSEC-2023-0071
Severity: 5.9 (medium)
Solution: No fixed upgrade is available!

Crate: atomic-polyfill
Version: 1.0.3
Warning: unmaintained
Title: atomic-polyfill is unmaintained
Date: 2023-07-11
ID: RUSTSEC-2023-0089
URL: https://rustsec.org/advisories/RUSTSEC-2023-0089

Crate: bincode
Version: 1.3.3
Warning: unmaintained
Title: Bincode is unmaintained
Date: 2025-12-16
ID: RUSTSEC-2025-0141
URL: https://rustsec.org/advisories/RUSTSEC-2025-0141

Crate: paste
Version: 1.0.15
Warning: unmaintained
Title: paste - no longer maintained
Date: 2024-10-07
ID: RUSTSEC-2024-0436
URL: https://rustsec.org/advisories/RUSTSEC-2024-0436

Crate: proc-macro-error
Version: 1.0.4
Warning: unmaintained
Title: proc-macro-error is unmaintained
Date: 2024-09-01
ID: RUSTSEC-2024-0370
URL: https://rustsec.org/advisories/RUSTSEC-2024-0370

Crate: proc-macro-error2
Version: 2.0.1
Warning: unmaintained
Title: proc-macro-error2 is unmaintained
Date: 2026-06-07
ID: RUSTSEC-2026-0173
URL: https://rustsec.org/advisories/RUSTSEC-2026-0173

Crate: rustls-pemfile
Version: 2.2.0
Warning: unmaintained
Title: rustls-pemfile is unmaintained
Date: 2025-11-28
ID: RUSTSEC-2025-0134
URL: https://rustsec.org/advisories/RUSTSEC-2025-0134

Crate: rustybuzz
Version: 0.20.1
Warning: unmaintained
Title: rustybuzz is unmaintained
Date: 2026-07-11
ID: RUSTSEC-2026-0206
URL: https://rustsec.org/advisories/RUSTSEC-2026-0206

Crate: ttf-parser
Version: 0.25.1
Warning: unmaintained
Title: ttf-parser is unmaintained
Date: 2026-06-28
ID: RUSTSEC-2026-0192
URL: https://rustsec.org/advisories/RUSTSEC-2026-0192

Crate: anyhow
Version: 1.0.102
Warning: unsound
Title: Unsoundness in Error::downcast_mut()
Date: 2026-06-25
ID: RUSTSEC-2026-0190
URL: https://rustsec.org/advisories/RUSTSEC-2026-0190

Crate: spin
Version: 0.9.8
Warning: yanked

[ryerraguntla]

Github of advisories - https://github.com/advisories
https://rustsec.debian.net/
https://osv.dev/

[ryerraguntla]

Based on the analysis, I am creating 3 GH Issues.

1. To audit current Iggy repo and fix the issues mentioned earlier in the discussion.
2. Implement "cargo deny" as part of pre-check
3. Make the production binaries auditable for CVEs using "cargo auditable".