search

realaravinth / libmedium

An Alternative Medium Frontend | Development continues at: https://git.batsense.net/realaravinth/libmedium
https://libmedium.batsense.net
GNU Affero General Public License v3.0
77 stars 7 forks source link

Vulnerabilities in libmedium crates #34

Closed F3llFr0mTh3Sky closed 4 months ago

F3llFr0mTh3Sky commented 4 months ago

calico@tux ~/Dépôts/realavarinth/libmedium $ cargo ebuild Error: Found 3 vulnerabilities:

Crate: h2 Version: 0.3.21 Title: Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS) Date: 2024-01-17 ID: RUSTSEC-2024-0003 URL: https://rustsec.org/advisories/RUSTSEC-2024-0003 Solution: Upgrade to ^0.3.24 or >=0.4.2

Crate: h2 Version: 0.3.21 Title: Degradation of service in h2 servers with CONTINUATION Flood Date: 2024-04-03 ID: RUSTSEC-2024-0332 URL: https://rustsec.org/advisories/RUSTSEC-2024-0332 Solution: Upgrade to ^0.3.26 or >=0.4.4

Crate: mio Version: 0.8.8 Title: Tokens for named pipes may be delivered after deregistration Date: 2024-03-04 ID: RUSTSEC-2024-0019 URL: https://rustsec.org/advisories/RUSTSEC-2024-0019 Solution: Upgrade to >=0.8.11

realaravinth commented 4 months ago

Thanks for the heads-up! o/

I installed renovate bot to ease maintenance. Almost all the dependencies are updated.

F3llFr0mTh3Sky commented 4 months ago

Very good. Thank you a lot. I'll be able to update the package for the gentoo distro.