search

rustsec / advisory-db

Security advisory database for Rust crates published through crates.io
https://rustsec.org
Other
887 stars 339 forks source link

ppv-lite86 appears unsound #1984

Open gendx opened 2 weeks ago

gendx commented 2 weeks ago

There is a pull request open for almost a year on the ppv-lite86 to fix unsoundness: https://github.com/cryptocorrosion/cryptocorrosion/pull/72. I didn't see activity on the repository since November 2022, so this doesn't look like it will be addressed any time soon.

Note that this is depended on by 14k crates, as it is a direct dependency of the rand_chacha crate.

tarcieri commented 2 weeks ago

You might mention this issue on that thread as a heads up, i.e. "There's an open issue to file a security advisory for this"

gendx commented 1 week ago

You might mention this issue on that thread as a heads up, i.e. "There's an open issue to file a security advisory for this"

Done.