Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Vendored crates with known vulnerabilities in Rust packages #141368

Open
sternenseemann opened this issue Oct 12, 2021 · 17 comments
Open

Vendored crates with known vulnerabilities in Rust packages #141368

sternenseemann opened this issue Oct 12, 2021 · 17 comments
Labels
1.severity: security 5. scope: tracking Long-lived issue tracking long-term fixes or multiple sub-problems 6.topic: rust

Comments

@sternenseemann
Copy link
Member

sternenseemann commented Oct 12, 2021

The vulnerability report below was generated by nixpkgs-crate-holes which extracts the Cargo.lock file of each package in nixpkgs with a cargoDeps attribute and passes it to cargo-audit using RustSec's advisory-db at d29205a.

Feel free to report any problems or suggest improvements in this Discourse thread or via email! Tick off any reports that have been fixed in the meantime.

Note: A vulnerability in a dependency does not necessarily mean the dependent package is vulnerable, e. g. when a vulnerable function isn't used.

398 of 665 checked attributes have vulnerable dependencies.

Generating Cargo.lock vulnerability reports

If you have a checkout of depot, you can generate this report using:

nix-build -A users.sterni.nixpkgs-crate-holes.full \
  --argstr nixpkgsPath /path/to/nixpkgs

If you want a more detailed report for a single attribute of nixpkgs, use:

nix-build -A users.sterni.nixpkgs-crate-holes.single \
  --argstr nixpkgsPath /path/to/nixpkgs --arg attr '[ "ripgrep" ]'
@nixos-discourse
Copy link

This issue has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/vulnerability-report-for-vendored-rust-crates/15462/1

@newAM
Copy link
Member

newAM commented Oct 13, 2021

cargo-embed is secure with the current feature set used in nixpkgs:

cargoBuildFlags = [ "--features=ftdi" ];

All 3 vulnerabilities come from dependencies that are added when built with the sentry feature (used to report crash data).

Edit: cargo-flash is also secure for the same reasons.

@newAM
Copy link
Member

newAM commented Oct 13, 2021

cargo-deadlinks is updated in #141454

@06kellyjac
Copy link
Member

06kellyjac commented Oct 13, 2021

Thanks for doing this @sternenseemann
Would it be possible to get this as separate issues and pinging maintainers going forward like the vulnerability roundup?

If I wasn't keeping a regular eye on the matrix security channel I wouldn't have spotted this, so it'd have the benefit of notifying maintainers without the issue of pinging everyone and having everyone commenting updates in the same issue

Working on getting agate updated upstream (if it takes more than a couple days to be merged and released I guess I'll patch it in). There's a new release of deno so I'll check that's resolved it. I'll also check bat.

Edit: deno vulns are resolved by #141433

@sternenseemann
Copy link
Member Author

Would it be possible to get this as separate issues and pinging maintainers going forward like the vulnerability roundup?

I'd like to keep it a single issue at a time, since it's much easier to deal with (no need to interact with the GitHub API…) and there are quite a lot of false positives. For the same reason I didn't want to ping maintainers just yet, but I was thinking of whitelisting maintainers to be pinged?

@06kellyjac
Copy link
Member

That's reasonable. I'd be happy to be on the list if you add that.

If it could be marked next to the packages that'd help me jump to the ones I maintain. If that's too much effort I can always crossreference against repology

@KamilaBorowska
Copy link
Member

KamilaBorowska commented Nov 16, 2021

python3{8,9}Packages.skytemple-rust can be marked as solved.

@turboMaCk
Copy link
Member

@zwilias Are there any plans to patch elm-json?

@zwilias
Copy link

zwilias commented Dec 30, 2021

@turboMaCk I'm traveling right now but I'll get on it in a couple of days. Thanks for the ping 👍

@zwilias
Copy link

zwilias commented Jan 16, 2022

@turboMaCk some delay, but v0.2.12 was published and got rid of/updated all dependencies that were causing warnings here 😄

@turboMaCk
Copy link
Member

sounds great. thanks @zwilias

@mweinelt
Copy link
Member

rust-cbindgen is using smallvec 1.8.0, so marked resolved

@sternenseemann
Copy link
Member Author

sternenseemann commented May 12, 2022

Updated report, split into two comments since it has become too long for GitHub's comment limit


The vulnerability report below was generated by nixpkgs-crate-holes which extracts the Cargo.lock file of each package in nixpkgs with a cargoDeps attribute and passes it to cargo-audit using RustSec's advisory-db at 2875efb.

Feel free to report any problems or suggest improvements (I have an email address on my profile and hang out on Matrix/libera.chat as sterni)! Tick off any reports that have been fixed in the meantime.

Note: A vulnerability in a dependency does not necessarily mean the dependent package is vulnerable, e. g. when a vulnerable function isn't used.

@sternenseemann

This comment was marked as outdated.

@sternenseemann
Copy link
Member Author

sternenseemann commented May 12, 2022

672 of 825 checked attributes have vulnerable dependencies.

Generating Cargo.lock vulnerability reports

If you have a checkout of depot, you can generate this report using:

nix-build -A users.sterni.nixpkgs-crate-holes.full \
  --argstr nixpkgsPath /path/to/nixpkgs

If you want a more detailed report for a single attribute of nixpkgs, use:

nix-build -A users.sterni.nixpkgs-crate-holes.single \
  --argstr nixpkgsPath /path/to/nixpkgs --arg attr '[ "ripgrep" ]'

@nixos-discourse
Copy link

This issue has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/packages-marked-as-broken-should-come-with-an-explanation/19187/9

@aktaboot
Copy link
Contributor

it would be nice to have an updated version of the list if possible. I failed trying to generate one

@tomodachi94 tomodachi94 added the 5. scope: tracking Long-lived issue tracking long-term fixes or multiple sub-problems label May 16, 2024
@Melkor333 Melkor333 mentioned this issue Jul 16, 2024
13 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
1.severity: security 5. scope: tracking Long-lived issue tracking long-term fixes or multiple sub-problems 6.topic: rust
Projects
None yet
Development

No branches or pull requests

10 participants