Bug 2214229 - RUSTSEC-2023-0042: ouroboros < 0.16 is unsound
Summary: RUSTSEC-2023-0042: ouroboros < 0.16 is unsound
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: rust-zoxide
Version: 39
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Rust SIG
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 2214198
TreeView+ depends on / blocked
 
Reported: 2023-06-12 10:10 UTC by Fabio Valentini
Modified: 2023-08-16 08:10 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:

Attachments (Terms of Use)

Description Fabio Valentini 2023-06-12 10:10:11 UTC 
c.f. https://rustsec.org/advisories/RUSTSEC-2023-0042.html

The ouroboros crate is affected by soundness issues, which could result in invalid code being generated in future versions of Rust. The upstream project recommends to migrate to the self_cell crate:

https://github.com/joshua-maros/ouroboros/issues/88

Reproducible: Always
Comment 1 Christian Heimes 2023-08-14 08:12:52 UTC 
ouroboros 0.17.2 is now available in Rawhide. You can update zoxide to 0.9.2 now, https://crates.io/crates/zoxide/0.9.2/dependencies
Comment 2 Fabio Valentini 2023-08-14 09:54:06 UTC 
No, I can't. Version 0.9.2 of zoxide adds new dependencies that aren't packaged for Fedora yet.
This is the reason why breaking updates need to be coordinated with *all* dependent packages.
Comment 3 Fedora Release Engineering 2023-08-16 08:10:56 UTC 
This bug appears to have been reported against 'rawhide' during the Fedora Linux 39 development cycle.
Changing version to 39.
Note You need to log in before you can comment on or make changes to this bug.