search

rustsec / advisory-db

Security advisory database for Rust crates published through crates.io
https://rustsec.org
Other
922 stars 364 forks source link

Add disclosure for hasbrown's borsh encoding #2100

Open kayabaNerve opened 1 month ago

kayabaNerve commented 1 month ago

I wrote this as fixed in 0.16 due to that being the plan documented here: https://github.com/rust-lang/hashbrown/pull/570#issuecomment-2406017398

Until that PR is merged and 0.16 is released, this cannot be merged/must be edited to be described as unpatched.

clarfonthey commented 1 month ago

There was a proposal to release the fix as 0.15.1 and just yank 0.15.0, so, might be worth verifying which of the two versions is going to be used for the fix.

kayabaNerve commented 1 month ago

I've removed the patched notice so this can be filed now (warning other people off from adopting this functionality) while we continue to wait for a patched version.

kayabaNerve commented 6 days ago

Sorry for my delay in updating this. It correctly notes when patched now.