-
Notifications
You must be signed in to change notification settings - Fork 720
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
make audit is failing #2698
Comments
bors bot
pushed a commit
that referenced
this issue
Oct 11, 2021
## Issue Addressed Fix `cargo audit` failures on `unstable` Closes #2698 ## Proposed Changes The main culprit is `nix`, which is vulnerable for versions below v0.23.0. We can't get by with a straight-forward `cargo update` because `psutil` depends on an old version of `nix` (cf. rust-psutil/rust-psutil#93). Hence I've temporarily forked `psutil` under the `sigp` org, where I've included the update to `nix` v0.23.0. Additionally, I took the chance to update the `time` dependency to v0.3, which removed a bunch of stale deps including `stdweb` which is no longer maintained. Lighthouse only uses the `time` crate in the notifier to do some pretty printing, and so wasn't affected by any of the breaking changes in v0.3 ([changelog here](https://github.com/time-rs/time/blob/main/CHANGELOG.md#030-2021-07-30)).
Fixed by #2699 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description
When executing
make audit
it fails because of RUSTSEC-2021-0119.Version
Unstable at commit 7c7ba77
$ make audit
cargo install --force cargo-audit
Updating crates.io index
Installing cargo-audit v0.15.2
Compiling proc-macro2 v1.0.29
Compiling unicode-xid v0.2.2
Compiling libc v0.2.103
...
Compiling rustsec v0.24.3
Compiling cargo-audit v0.15.2
Finished release [optimized] target(s) in 34.16s
Replacing /home/wink/.cargo/bin/cargo-audit
Replaced package
cargo-audit v0.15.2
withcargo-audit v0.15.2
(executablecargo-audit
)cargo audit
Fetching advisory database from
https://github.com/RustSec/advisory-db.git
Loaded 367 security advisories (from /home/wink/.cargo/advisory-db)
Updating crates.io index
Scanning Cargo.lock for vulnerabilities (651 crate dependencies)
Crate: nix
Version: 0.17.0
Title: Out-of-bounds write in nix::unistd::getgrouplist
Date: 2021-09-27
ID: RUSTSEC-2021-0119
URL: https://rustsec.org/advisories/RUSTSEC-2021-0119
Solution: Upgrade to ^0.20.2 OR ^0.21.2 OR ^0.22.2 OR >=0.23.0
Dependency tree:
nix 0.17.0
Crate: nix
Version: 0.22.0
Title: Out-of-bounds write in nix::unistd::getgrouplist
Date: 2021-09-27
ID: RUSTSEC-2021-0119
URL: https://rustsec.org/advisories/RUSTSEC-2021-0119
Solution: Upgrade to ^0.20.2 OR ^0.21.2 OR ^0.22.2 OR >=0.23.0
Dependency tree:
nix 0.22.0
Crate: stdweb
Version: 0.4.20
Warning: unmaintained
Title: stdweb is unmaintained
Date: 2020-05-04
ID: RUSTSEC-2020-0056
URL: https://rustsec.org/advisories/RUSTSEC-2020-0056
Dependency tree:
stdweb 0.4.20
└── time 0.2.27
error: 2 vulnerabilities found!
warning: 1 allowed warning found
make: *** [Makefile:154: audit] Error 1
The text was updated successfully, but these errors were encountered: