Bug 2214208 - RUSTSEC-2023-0020: const-cstr is unmaintained [NEEDINFO]
Summary: RUSTSEC-2023-0020: const-cstr is unmaintained
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: libblkio
Version: rawhide
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Stefan Hajnoczi
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2177737
TreeView+ depends on / blocked
 
Reported: 2023-06-12 09:51 UTC by Fabio Valentini
Modified: 2023-08-14 13:54 UTC (History)
3 users (show)

Fixed In Version: 1.3.0 libblkio-1.3.0-2.fc40 libblkio-1.3.0-2.fc39
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2023-08-14 13:51:37 UTC
Type: ---
Embargoed:
rjones: needinfo? (stefanha)


Attachments (Terms of Use)

Description Fabio Valentini 2023-06-12 09:51:46 UTC
c.f. https://rustsec.org/advisories/RUSTSEC-2023-0020.html

The last release of the "const-cstr" crate was on 2018-02-10. This is also the last day on which code changes happened in the project's git repo on GitHub. The project is now a read-only archive.

The code has some issues that violate Rust soundness rules and can lead to panics when parsing untrusted data.

The const_str and cstr crates are listed as possible alternatives.

Reproducible: Always

Comment 1 Stefan Hajnoczi 2023-06-20 14:17:45 UTC
The const-cstr crate dependency was dropped upstream in libblkio 1.3.0.

Comment 2 Stefan Hajnoczi 2023-06-20 14:19:15 UTC
There is no Fedora libblkio 1.3.0 package yet because I was waiting for dependencies with the right version to become available in Fedora.

I've moved this BZ back to ASSIGNED for now. Once libblkio 1.3.0 is packaged in Fedora this issue will be solved.

Comment 3 Richard W.M. Jones 2023-08-14 12:09:26 UTC
Since 1.3.0 has been shipped in Rawhide, can we close this now?

Comment 4 Fabio Valentini 2023-08-14 13:18:39 UTC
(In reply to Stefan Hajnoczi from comment #1)
> The const-cstr crate dependency was dropped upstream in libblkio 1.3.0.

It wasn't dropped from the spec file though:
https://src.fedoraproject.org/rpms/libblkio/blob/rawhide/f/libblkio.spec#_45

Note that the %cargo_generate_buildrequires macro now supports workspaces, you should be able to use it instead of hard-coding the Rust dependencies.

Comment 5 Richard W.M. Jones 2023-08-14 13:25:06 UTC
Just for the sake of moving this bug along I did a scratch build which removes
the const-cstr build dependency:

https://koji.fedoraproject.org/koji/taskinfo?taskID=104829509

If successful I guess we should push this change, close the bug, and look
at using %cargo_generate_buildrequires in future.

Comment 7 Fedora Update System 2023-08-14 13:49:54 UTC
FEDORA-2023-fbe9134000 has been submitted as an update to Fedora 40. https://bodhi.fedoraproject.org/updates/FEDORA-2023-fbe9134000

Comment 8 Fedora Update System 2023-08-14 13:51:37 UTC
FEDORA-2023-fbe9134000 has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 9 Fedora Update System 2023-08-14 13:52:31 UTC
FEDORA-2023-a39b6b6db7 has been submitted as an update to Fedora 39. https://bodhi.fedoraproject.org/updates/FEDORA-2023-a39b6b6db7

Comment 10 Fedora Update System 2023-08-14 13:54:37 UTC
FEDORA-2023-a39b6b6db7 has been pushed to the Fedora 39 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.