dep: upgrade openssl to 0.10.55 to fix cve warnings

error[vulnerability]: `openssl` `X509VerifyParamRef::set_host` buffer over-read ┌─ /github/workspace/Cargo.lock:122:1 │ 122 │ openssl 0.10.48 registry+https://github.com/rust-lang/crates.io-index │ --------------------------------------------------------------------- security vulnerability detected │ = ID: RUSTSEC-2023-0044 = Advisory: https://rustsec.org/advisories/RUSTSEC-2023-0044 = When this function was passed an empty string, `openssl` would attempt to call `strlen` on it, reading arbitrary memory until it reached a NUL byte. = Announcement: sfackler/rust-openssl#1965 = Solution: Upgrade to >=0.10.55 Signed-off-by: Jiang Liu <[email protected]>
dragonflyoss · Jun 21, 2023 · 6c75349 · 6c75349
1 parent 6e1e6c0
commit 6c75349
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 6 deletions.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -52,7 +52,7 @@ tar = "0.4.38"
 tokio = { version = "1.24", features = ["macros"] }
 
 # Build static linked openssl library
-openssl = { version = "0.10.48", features = ["vendored"] }
+openssl = { version = "0.10.55", features = ["vendored"] }
 # pin openssl-src to bring in fix for https://rustsec.org/advisories/RUSTSEC-2022-0032
 #openssl-src = { version = "111.22" }