Join GitHub today
GitHub is home to over 31 million developers working together to host and review code, manage projects, and build software together.
Sign upRustSec integration into crates.io UI #16
Comments
This comment has been minimized.
This comment has been minimized.
|
Potentially related issues: rust-lang/cargo#2608 |
Shnatsel
added
the
2019 goal
label
Jan 14, 2019
briansmith
referenced this issue
Jan 29, 2019
Closed
Why were all versions prior to 0.14 of this crate yanked? #774
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Shnatsel commentedJan 8, 2019
•
edited
Some crates on crates.io pull in vulnerable versions of transitive dependencies that do not have a semver-compatible upgrade path. An example of this is OpenSSL crate which is vulnerable to trivial MitM in versions prior to 0.9. There currently exists a crate with 8000+ downloads in the last 3 months that depends on a vulnerable version of OpenSSL, and this info is not exposed on crates.io in any way, so the crate might keep accumulating unsuspecting users.
We need to display vulnerabilities in transitive dependencies in crates.io UI so that people can fix or avoid poorly maintained dependencies.
Advisory database: https://github.com/RustSec/advisory-db
Tool for checking crates.io index against it: https://gitlab.com/zachreizner/crates-audit/ originally requested in #13