Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

vuln: update dependencies to remove unsafe generator package #80

Conversation

brandon-at-wrk
Copy link
Contributor

@brandon-at-wrk brandon-at-wrk commented Jul 1, 2021

Hi maintainers! I'm Brandon and I work at Bison Trails. We're doing an internal hackathon this week focused on security.

Our team loves kubie, but it got flagged during a recent security review. Our team voted to use our hackathon time to patch vulnerabilities in our favorite OSS tools and specifically to try to get kubie approved for usage within our organization.

What's here:

  • Update dependencies in Cargo.lock to fix RUSTSEC-2020-0151
    • Removes the generator sub-dependency which contained a memory-security vulnerability.

Impact:

These changes should improve kubie's security posture. We identified these vulnerabilities using Salus and the OSSF scorecard.

Thank you so much for your work maintaining kubie, and thank you for taking the time to look at these proposed changes!

- `generator` package was a sub dependency that had a
  memory corruption vulnerability
@brandon-at-wrk brandon-at-wrk marked this pull request as ready for review July 1, 2021 21:00
@sbstp
Copy link
Owner

sbstp commented Jul 1, 2021

Thanks!

@sbstp sbstp merged commit afda6f7 into sbstp:master Jul 1, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants