Bug 2214229

Summary:	RUSTSEC-2023-0042: ouroboros < 0.16 is unsound
Product:	[Fedora] Fedora	Reporter:	Fabio Valentini <decathorpe>
Component:	rust-zoxide	Assignee:	Rust SIG <rust-sig>
Status:	NEW ---	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	39	CC:	98ajeet, cheimes, igor.raits, rust-sig
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2214198

Description Fabio Valentini 2023-06-12 10:10:11 UTC

c.f. https://rustsec.org/advisories/RUSTSEC-2023-0042.html

The ouroboros crate is affected by soundness issues, which could result in invalid code being generated in future versions of Rust. The upstream project recommends to migrate to the self_cell crate:

https://github.com/joshua-maros/ouroboros/issues/88

Reproducible: Always

Comment 1 Christian Heimes 2023-08-14 08:12:52 UTC

ouroboros 0.17.2 is now available in Rawhide. You can update zoxide to 0.9.2 now, https://crates.io/crates/zoxide/0.9.2/dependencies

Comment 2 Fabio Valentini 2023-08-14 09:54:06 UTC

No, I can't. Version 0.9.2 of zoxide adds new dependencies that aren't packaged for Fedora yet.
This is the reason why breaking updates need to be coordinated with *all* dependent packages.

Comment 3 Fedora Release Engineering 2023-08-16 08:10:56 UTC

This bug appears to have been reported against 'rawhide' during the Fedora Linux 39 development cycle.
Changing version to 39.