etesync / etebase-py

A Python client library for Etebase
https://www.etebase.com
BSD 3-Clause "New" or "Revised" License
70 stars 14 forks source link

Vulnerabilities in crates #52

Closed CaseOf closed 10 months ago

CaseOf commented 10 months ago

I am writing an ebuild for Gentoo for this lib and cargo-ebuild gave me this result:

Error: Found 6 vulnerabilities:

Crate:    openssl-src
Version:  111.24.0+1.1.1s
Title:    Double free after calling `PEM_read_bio_ex`
Date:     2023-02-07
ID:       RUSTSEC-2023-0010
URL:      https://rustsec.org/advisories/RUSTSEC-2023-0010
Solution: Upgrade to >=111.25, <300.0 or >=300.0.12

Crate:    openssl-src
Version:  111.24.0+1.1.1s
Title:    Timing Oracle in RSA Decryption
Date:     2023-02-07
ID:       RUSTSEC-2023-0007
URL:      https://rustsec.org/advisories/RUSTSEC-2023-0007
Solution: Upgrade to >=111.25, <300.0 or >=300.0.12

Crate:    openssl-src
Version:  111.24.0+1.1.1s
Title:    Use-after-free following `BIO_new_NDEF`
Date:     2023-02-07
ID:       RUSTSEC-2023-0009
URL:      https://rustsec.org/advisories/RUSTSEC-2023-0009
Solution: Upgrade to >=111.25, <300.0 or >=300.0.12

Crate:    openssl-src
Version:  111.24.0+1.1.1s
Title:    X.400 address type confusion in X.509 `GeneralName`
Date:     2023-02-07
ID:       RUSTSEC-2023-0006
URL:      https://rustsec.org/advisories/RUSTSEC-2023-0006
Solution: Upgrade to >=111.25, <300.0 or >=300.0.12

Crate:    remove_dir_all
Version:  0.5.3
Title:    Race Condition Enabling Link Following and Time-of-check Time-of-use (TOCTOU)
Date:     2023-02-24
ID:       RUSTSEC-2023-0018
URL:      https://rustsec.org/advisories/RUSTSEC-2023-0018
Solution: Upgrade to >=0.8.0

Crate:    remove_dir_all
Version:  0.6.1
Title:    Race Condition Enabling Link Following and Time-of-check Time-of-use (TOCTOU)
Date:     2023-02-24
ID:       RUSTSEC-2023-0018
URL:      https://rustsec.org/advisories/RUSTSEC-2023-0018
Solution: Upgrade to >=0.8.0

Please fix the issues or use "--noaudit" flag.
tasn commented 10 months ago

Fixed, thanks! (see most recent version)