Bug 2214227

Summary:	RUSTSEC-2023-0042: ouroboros is unsound
Product:	[Fedora] Fedora	Reporter:	Fabio Valentini <decathorpe>
Component:	mercurial	Assignee:	Mads Kiilerich <mads>
Status:	CLOSED RAWHIDE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	fedoraproject.org, mads, ndbecker2, opohorel, pstodulk
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-07-30 17:07:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2214198

Description Fabio Valentini 2023-06-12 10:09:31 UTC

c.f. https://rustsec.org/advisories/RUSTSEC-2023-0042.html

The ouroboros crate is affected by soundness issues, which could result in invalid code being generated in future versions of Rust. The upstream project recommends to migrate to the self_cell crate:

https://github.com/joshua-maros/ouroboros/issues/88

Reproducible: Always

Comment 1 Fabio Valentini 2023-07-30 17:07:15 UTC

mercurial has migrated to self_cell and is no longer affected.