Invalid data from hyper/RUSTSEC-2017-0002.toml

[fiorix]

The patched_versions in hyper/RUSTSEC-2017-0002.toml has a couple of ranges in the same item, and is the only file like that:

advisory-db $ grep -r patched crates/*
crates/arrayfire/RUSTSEC-2018-0011.toml:patched_versions = [">= 3.6.0"]
crates/base64/RUSTSEC-2017-0004.toml:patched_versions = [">= 0.5.2"]
crates/claxon/RUSTSEC-2018-0004.toml:patched_versions = ["=0.3.2", ">= 0.4.1"]
crates/cookie/RUSTSEC-2017-0005.toml:patched_versions = ["< 0.6.0", "^0.6.2", ">= 0.7.6"]
crates/crossbeam/RUSTSEC-2018-0009.toml:patched_versions = [">= 0.4.1"]
crates/hyper/RUSTSEC-2017-0002.toml:patched_versions = [">= 0.10.2", "< 0.10.0, >= 0.9.18"]
crates/hyper/RUSTSEC-2016-0002.toml:patched_versions = [">= 0.9.4"]
crates/openssl/RUSTSEC-2018-0010.toml:patched_versions = [">= 0.10.9"]
crates/openssl/RUSTSEC-2016-0001.toml:patched_versions = [">= 0.9.0"]
crates/orion/RUSTSEC-2018-0012.toml:patched_versions = [">= 0.11.2"]
crates/safe-transmute/RUSTSEC-2018-0013.toml:patched_versions = [">= 0.10.1"]
crates/security-framework/RUSTSEC-2017-0003.toml:patched_versions = [">= 0.1.12"]
crates/serde_yaml/RUSTSEC-2018-0005.toml:patched_versions = [">= 0.8.4"]
crates/slice-deque/RUSTSEC-2018-0008.toml:patched_versions = [">= 0.1.16"]
crates/smallvec/RUSTSEC-2018-0003.toml:patched_versions = [">= 0.6.3", "^0.3.4", "^0.4.5", "^0.5.1"]
crates/sodiumoxide/RUSTSEC-2017-0001.toml:patched_versions = [">= 0.0.14"]
crates/tar/RUSTSEC-2018-0002.toml:patched_versions = [">= 0.4.16"]
crates/trust-dns-proto/RUSTSEC-2018-0007.toml:patched_versions = [">= 0.4.3", ">= 0.5.0-alpha.3" ]
crates/untrusted/RUSTSEC-2018-0001.toml:patched_versions = [">= 0.6.2"]
crates/yaml-rust/RUSTSEC-2018-0006.toml:patched_versions = [">= 0.4.1"]

crates/hyper/RUSTSEC-2017-0002.toml:patched_versions = [">= 0.10.2", "< 0.10.0, >= 0.9.18"]

Is this intended, or is it a bug?

[tarcieri]

Those are two VersionReq expressions:

• >= 0.10.2
• < 0.10.0, >= 0.9.18

The corresponding VersionReqs for the vulnerable versions would be:

• < 0.10.2, >= 0.10.10 OR < 0.9.18

I'd double check with @seanmonstar that this is actually what was intended, but otherwise it's a valid version expression (that is why they are TOML arrays).

If you're having trouble parsing them, I'd suggest using the rustsec crate to parse them, or otherwise a similar SemVer library in other languages capable of parsing version requirements.