Tungstenite allows remote attackers to cause a denial of service (RUSTSEC-2023-0065)

[DuckDuckWhale]

Problem

As of current master (49fce66):

mdBook$ cargo audit
...
Crate:     tungstenite
Version:   0.18.0
Title:     Tungstenite allows remote attackers to cause a denial of service
Date:      2023-09-25
ID:        RUSTSEC-2023-0065
URL:       https://rustsec.org/advisories/RUSTSEC-2023-0065
Severity:  7.5 (high)
Solution:  Upgrade to >=0.20.1
Dependency tree:
tungstenite 0.18.0
└── tokio-tungstenite 0.18.0
    └── warp 0.3.5
        └── mdbook 0.4.35

error: 1 vulnerability found!

Steps

1. git clone https://github.com/rust-lang/mdBook
2. cd mdBook
3. cargo install cargo-audit --locked
4. cargo audit

Possible Solution(s)

Upgrade to >=0.20.1

Notes

No response

Version

mdbook v0.4.35

[Dylan-DPC]

@DuckDuckWhale thanks for the issue. this is blocked on warp updating their dependency of tokio-tungstenite while we follow up and bump the version of warp accordingly.