Bug 2214208

Summary:	RUSTSEC-2023-0020: const-cstr is unmaintained
Product:	[Fedora] Fedora	Reporter:	Fabio Valentini <decathorpe>
Component:	libblkio	Assignee:	Stefan Hajnoczi <stefanha>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	afaria, rjones, stefanha
Target Milestone:	---	Keywords:	Reopened
Target Release:	---	Flags:	rjones: needinfo? (stefanha)
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:	1.3.0 libblkio-1.3.0-2.fc40 libblkio-1.3.0-2.fc39	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-08-14 13:51:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2177737

Description Fabio Valentini 2023-06-12 09:51:46 UTC

c.f. https://rustsec.org/advisories/RUSTSEC-2023-0020.html

The last release of the "const-cstr" crate was on 2018-02-10. This is also the last day on which code changes happened in the project's git repo on GitHub. The project is now a read-only archive.

The code has some issues that violate Rust soundness rules and can lead to panics when parsing untrusted data.

The const_str and cstr crates are listed as possible alternatives.

Reproducible: Always

Comment 1 Stefan Hajnoczi 2023-06-20 14:17:45 UTC

The const-cstr crate dependency was dropped upstream in libblkio 1.3.0.

Comment 2 Stefan Hajnoczi 2023-06-20 14:19:15 UTC

There is no Fedora libblkio 1.3.0 package yet because I was waiting for dependencies with the right version to become available in Fedora.

I've moved this BZ back to ASSIGNED for now. Once libblkio 1.3.0 is packaged in Fedora this issue will be solved.

Comment 3 Richard W.M. Jones 2023-08-14 12:09:26 UTC

Since 1.3.0 has been shipped in Rawhide, can we close this now?

Comment 4 Fabio Valentini 2023-08-14 13:18:39 UTC

(In reply to Stefan Hajnoczi from comment #1)
> The const-cstr crate dependency was dropped upstream in libblkio 1.3.0.

It wasn't dropped from the spec file though:
https://src.fedoraproject.org/rpms/libblkio/blob/rawhide/f/libblkio.spec#_45

Note that the %cargo_generate_buildrequires macro now supports workspaces, you should be able to use it instead of hard-coding the Rust dependencies.

Comment 5 Richard W.M. Jones 2023-08-14 13:25:06 UTC

Just for the sake of moving this bug along I did a scratch build which removes
the const-cstr build dependency:

https://koji.fedoraproject.org/koji/taskinfo?taskID=104829509

If successful I guess we should push this change, close the bug, and look
at using %cargo_generate_buildrequires in future.

Comment 6 Richard W.M. Jones 2023-08-14 13:45:57 UTC

F40: https://koji.fedoraproject.org/koji/taskinfo?taskID=104830518
F39: https://koji.fedoraproject.org/koji/taskinfo?taskID=104830783

Comment 7 Fedora Update System 2023-08-14 13:49:54 UTC

FEDORA-2023-fbe9134000 has been submitted as an update to Fedora 40. https://bodhi.fedoraproject.org/updates/FEDORA-2023-fbe9134000

Comment 8 Fedora Update System 2023-08-14 13:51:37 UTC

FEDORA-2023-fbe9134000 has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 9 Fedora Update System 2023-08-14 13:52:31 UTC

FEDORA-2023-a39b6b6db7 has been submitted as an update to Fedora 39. https://bodhi.fedoraproject.org/updates/FEDORA-2023-a39b6b6db7

Comment 10 Fedora Update System 2023-08-14 13:54:37 UTC

FEDORA-2023-a39b6b6db7 has been pushed to the Fedora 39 stable repository.
If problem still persists, please make note of it in this bug report.