Skip to content

Commit cfb30ca

Browse files
charlesxshcharlesxsh
authored
Merge branch 'rustsec:main' into main
2 parents ed57b6e + 2e45336 commit cfb30ca

File tree

145 files changed

+1089
-107
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

145 files changed

+1089
-107
lines changed

‎.duplicate-id-guard‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
This file causes merge conflicts if two ID assignment jobs run concurrently.
22
This prevents duplicate ID assignment due to a race between those jobs.
3-
31a8abd8cc612f6b98d74d057b6404593b695fc8824cd6fb0236e21eaa7b4b39 -
3+
2b5bd0ab899546e88868be2b55d831a7d846a79264cdae63a1bde3a533207f28 -

‎.github/dependabot.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,5 @@ updates:
55
schedule:
66
interval: "weekly"
77
open-pull-requests-limit: 10
8+
cooldown:
9+
default-days: 7

‎.github/workflows/assign-ids.yml‎

Lines changed: 39 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -4,40 +4,47 @@ on:
44
push:
55
branches: main
66

7+
permissions: {}
8+
79
jobs:
810
assign-ids:
911
name: Assign IDs
1012
runs-on: ubuntu-latest
13+
permissions:
14+
contents: write # for create-pull-request
15+
pull-requests: write # for create-pull-request
1116
steps:
12-
- uses: actions/checkout@v5
13-
14-
- name: Cache cargo bin
15-
id: admin-cache
16-
uses: actions/cache@v4
17-
with:
18-
path: ~/.cargo/bin
19-
key: rustsec-admin-b7c69254bda9b8f4c94bc5eaef47e5bb3a97d8cd
20-
21-
- name: Install rustsec-admin
22-
if: steps.admin-cache.outputs.cache-hit != 'true'
23-
run: cargo install --git https://github.com/rustsec/rustsec rustsec-admin --rev b7c69254bda9b8f4c94bc5eaef47e5bb3a97d8cd
24-
25-
- name: Assign IDs
26-
id: assign
27-
run: |
28-
message=$(rustsec-admin assign-id --github-actions-output)
29-
echo "commit_message=${message}" >> $GITHUB_OUTPUT
30-
31-
- name: Create duplicate ID assignment guard
32-
run: |
33-
echo "This file causes merge conflicts if two ID assignment jobs run concurrently." > .duplicate-id-guard
34-
echo "This prevents duplicate ID assignment due to a race between those jobs." >> .duplicate-id-guard
35-
ls -R ./crates/ ./rust/ | sha256sum >> .duplicate-id-guard
36-
37-
- name: Create pull request
38-
uses: peter-evans/create-pull-request@v7
39-
with:
40-
token: ${{ secrets.GITHUB_TOKEN }}
41-
commit-message: ${{ steps.assign.outputs.commit_message }}
42-
title: ${{ steps.assign.outputs.commit_message }}
43-
branch: assign-ids
17+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
18+
with:
19+
persist-credentials: false
20+
21+
- name: Cache cargo bin
22+
id: admin-cache
23+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
24+
with:
25+
path: ~/.cargo/bin
26+
key: rustsec-admin-4f949d61d9ed2ef59f8c4448b5ab96e6eef0d6ed
27+
28+
- name: Install rustsec-admin
29+
if: steps.admin-cache.outputs.cache-hit != 'true'
30+
run: cargo install --git https://github.com/rustsec/rustsec rustsec-admin --rev 4f949d61d9ed2ef59f8c4448b5ab96e6eef0d6ed
31+
32+
- name: Assign IDs
33+
id: assign
34+
run: |
35+
message=$(rustsec-admin assign-id --github-actions-output)
36+
echo "commit_message=${message}" >> $GITHUB_OUTPUT
37+
38+
- name: Create duplicate ID assignment guard
39+
run: |
40+
echo "This file causes merge conflicts if two ID assignment jobs run concurrently." > .duplicate-id-guard
41+
echo "This prevents duplicate ID assignment due to a race between those jobs." >> .duplicate-id-guard
42+
ls -R ./crates/ ./rust/ | sha256sum >> .duplicate-id-guard
43+
44+
- name: Create pull request
45+
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
46+
with:
47+
token: ${{ secrets.GITHUB_TOKEN }}
48+
commit-message: ${{ steps.assign.outputs.commit_message }}
49+
title: ${{ steps.assign.outputs.commit_message }}
50+
branch: assign-ids

‎.github/workflows/export-osv.yml‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,23 +4,28 @@ on:
44
push:
55
branches: main
66

7+
permissions: {}
8+
79
jobs:
810
publish-web:
911
runs-on: ubuntu-latest
12+
permissions:
13+
contents: write # needed for pushing back to the repo
1014
steps:
11-
- uses: actions/checkout@v5
15+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
1216
with:
1317
ref: osv
18+
persist-credentials: true # persists the token for git push below
1419

15-
- uses: actions/cache@v4
20+
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
1621
id: admin-cache
1722
with:
1823
path: ~/.cargo/bin
19-
key: rustsec-admin-b7c69254bda9b8f4c94bc5eaef47e5bb3a97d8cd
24+
key: rustsec-admin-4f949d61d9ed2ef59f8c4448b5ab96e6eef0d6ed
2025

2126
- name: Install rustsec-admin
2227
if: steps.admin-cache.outputs.cache-hit != 'true'
23-
run: cargo install --git https://github.com/rustsec/rustsec rustsec-admin --rev b7c69254bda9b8f4c94bc5eaef47e5bb3a97d8cd
28+
run: cargo install --git https://github.com/rustsec/rustsec rustsec-admin --rev 4f949d61d9ed2ef59f8c4448b5ab96e6eef0d6ed
2429

2530
- run: |
2631
mkdir -p crates

‎.github/workflows/publish-web.yml‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,23 +4,28 @@ on:
44
push:
55
branches: main
66

7+
permissions: {}
8+
79
jobs:
810
publish-web:
911
runs-on: ubuntu-latest
12+
permissions:
13+
contents: write # needed for pushing back to the repo
1014
steps:
11-
- uses: actions/checkout@v5
15+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
1216
with:
1317
ref: gh-pages
18+
persist-credentials: true # persists the token for git push below
1419

15-
- uses: actions/cache@v4
20+
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
1621
id: admin-cache
1722
with:
1823
path: ~/.cargo/bin
19-
key: rustsec-admin-b7c69254bda9b8f4c94bc5eaef47e5bb3a97d8cd
24+
key: rustsec-admin-4f949d61d9ed2ef59f8c4448b5ab96e6eef0d6ed
2025

2126
- name: Install rustsec-admin
2227
if: steps.admin-cache.outputs.cache-hit != 'true'
23-
run: cargo install --git https://github.com/rustsec/rustsec rustsec-admin --rev b7c69254bda9b8f4c94bc5eaef47e5bb3a97d8cd
28+
run: cargo install --git https://github.com/rustsec/rustsec rustsec-admin --rev 4f949d61d9ed2ef59f8c4448b5ab96e6eef0d6ed
2429

2530
- run: |
2631
rustsec-admin web .

‎.github/workflows/sync-ids.yml‎

Lines changed: 34 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -4,40 +4,47 @@ on:
44
workflow_dispatch:
55
schedule:
66
# daily run on default "main" branch
7-
- cron: '30 1 * * *'
7+
- cron: "30 1 * * *"
8+
9+
permissions: {}
810

911
jobs:
1012
sync-ids:
1113
name: Synchronize IDs
1214
runs-on: ubuntu-latest
15+
permissions:
16+
contents: write # for create-pull-request
17+
pull-requests: write # for create-pull-request
1318
steps:
14-
- uses: actions/checkout@v5
19+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
20+
with:
21+
persist-credentials: false
1522

16-
- name: Cache cargo bin
17-
id: admin-cache
18-
uses: actions/cache@v4
19-
with:
20-
path: ~/.cargo/bin
21-
key: rustsec-admin-b7c69254bda9b8f4c94bc5eaef47e5bb3a97d8cd
23+
- name: Cache cargo bin
24+
id: admin-cache
25+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
26+
with:
27+
path: ~/.cargo/bin
28+
key: rustsec-admin-4f949d61d9ed2ef59f8c4448b5ab96e6eef0d6ed
2229

23-
- name: Install rustsec-admin
24-
if: steps.admin-cache.outputs.cache-hit != 'true'
25-
run: cargo install --git https://github.com/rustsec/rustsec rustsec-admin --rev b7c69254bda9b8f4c94bc5eaef47e5bb3a97d8cd
30+
- name: Install rustsec-admin
31+
if: steps.admin-cache.outputs.cache-hit != 'true'
32+
run: cargo install --git https://github.com/rustsec/rustsec rustsec-admin --rev 4f949d61d9ed2ef59f8c4448b5ab96e6eef0d6ed
2633

27-
- name: Synchronize IDs
28-
id: sync_ids
29-
run: |
30-
mkdir -p /tmp/osv
31-
curl --silent --output /tmp/osv/advisories.zip https://osv-vulnerabilities.storage.googleapis.com/crates.io/all.zip
32-
unzip -d /tmp/osv -q /tmp/osv/advisories.zip
33-
rustsec-admin sync --osv /tmp/osv/ .
34-
message="Synchronize IDs ($(date +%F))"
35-
echo "commit_message=${message}" >> $GITHUB_OUTPUT
34+
- name: Synchronize IDs
35+
id: sync_ids
36+
run: |
37+
mkdir -p /tmp/osv
38+
curl --silent --output /tmp/osv/advisories.zip https://osv-vulnerabilities.storage.googleapis.com/crates.io/all.zip
39+
unzip -d /tmp/osv -q /tmp/osv/advisories.zip
40+
rustsec-admin sync --osv /tmp/osv/ .
41+
message="Synchronize IDs ($(date +%F))"
42+
echo "commit_message=${message}" >> $GITHUB_OUTPUT
3643
37-
- name: Create pull request
38-
uses: peter-evans/create-pull-request@v7
39-
with:
40-
token: ${{ secrets.GITHUB_TOKEN }}
41-
commit-message: ${{ steps.sync_ids.outputs.commit_message }}
42-
title: ${{ steps.sync_ids.outputs.commit_message }}
43-
branch: sync-ids
44+
- name: Create pull request
45+
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
46+
with:
47+
token: ${{ secrets.GITHUB_TOKEN }}
48+
commit-message: ${{ steps.sync_ids.outputs.commit_message }}
49+
title: ${{ steps.sync_ids.outputs.commit_message }}
50+
branch: sync-ids

‎.github/workflows/validate.yml‎

Lines changed: 16 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,23 +5,27 @@ on:
55
push:
66
branches: main
77

8+
permissions: {}
9+
810
jobs:
911
lint:
1012
name: Lint advisories
1113
runs-on: ubuntu-latest
1214
steps:
13-
- uses: actions/checkout@v5
15+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
16+
with:
17+
persist-credentials: false
1418

15-
- name: Cache cargo bin
16-
id: admin-cache
17-
uses: actions/cache@v4
18-
with:
19-
path: ~/.cargo/bin
20-
key: rustsec-admin-b7c69254bda9b8f4c94bc5eaef47e5bb3a97d8cd
19+
- name: Cache cargo bin
20+
id: admin-cache
21+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
22+
with:
23+
path: ~/.cargo/bin
24+
key: rustsec-admin-4f949d61d9ed2ef59f8c4448b5ab96e6eef0d6ed
2125

22-
- name: Install rustsec-admin
23-
if: steps.admin-cache.outputs.cache-hit != 'true'
24-
run: cargo install --git https://github.com/rustsec/rustsec rustsec-admin --rev b7c69254bda9b8f4c94bc5eaef47e5bb3a97d8cd
26+
- name: Install rustsec-admin
27+
if: steps.admin-cache.outputs.cache-hit != 'true'
28+
run: cargo install --git https://github.com/rustsec/rustsec rustsec-admin --rev 4f949d61d9ed2ef59f8c4448b5ab96e6eef0d6ed
2529

26-
- name: Lint advisories
27-
run: rustsec-admin lint --skip-namecheck rustdecimal,vec-const
30+
- name: Lint advisories
31+
run: rustsec-admin lint --skip-namecheck rustdecimal,vec-const

‎crates/alloy-dyn-abi/RUSTSEC-2025-0073.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-2025-0073"
4+
package = "alloy-dyn-abi"
5+
date = "2025-10-15"
6+
url = "https://github.com/alloy-rs/core/security/advisories/GHSA-pgp9-98jm-wwq2"
7+
categories = ["denial-of-service"]
8+
cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
9+
keywords = ["uncaught-panic"]
10+
aliases = ["CVE-2025-62370", "GHSA-pgp9-98jm-wwq2"]
11+
12+
[affected.functions]
13+
"alloy_dyn_abi::eip712::Resolver::encode_type" = ["<0.8.26", ">=1.0.0, <1.4.1"]
14+
15+
[versions]
16+
patched = [">=0.8.26, <1.0.0", ">=1.4.1"]
17+
```
18+
19+
# DoS vulnerability on `alloy_dyn_abi::TypedData` hashing
20+
21+
An uncaught panic triggered by malformed input to `alloy_dyn_abi::TypedData` could lead to a denial-of-service (DoS) via `eip712_signing_hash()`.
22+
23+
Software with high availability requirements such as network services may be particularly impacted. If in use, external auto-restarting mechanisms can partially mitigate the availability issues unless repeated attacks are possible.
24+
25+
The vulnerability was patched by adding a check to ensure the element is not empty before accessing its first element; an error is returned if it is empty. The fix is included in version [v1.4.1](https://crates.io/crates/alloy-dyn-abi/1.4.1) and backported to [v0.8.26](https://crates.io/crates/alloy-dyn-abi/0.8.26).
26+
27+
There is no known workaround that mitigates the vulnerability. Upgrading to a patched version is the recommended course of action.
28+
29+
Reported by [Christian Reitter](https://github.com/cr-tk) & [Zeke Mostov](https://github.com/emostov) from [Turnkey](https://www.turnkey.com/).

‎crates/alloy-json-abi/RUSTSEC-2024-0362.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ package = "alloy-json-abi"
55
date = "2024-07-30"
66
url = "https://github.com/alloy-rs/core/issues/702"
77
keywords = ["stack-overflow"]
8+
aliases = ["GHSA-8327-84cj-8xjm"]
89

910
[versions]
1011
patched = [">= 0.7.7"]

‎crates/ammonia/RUSTSEC-2025-0071.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ package = "ammonia"
55
date = "2025-09-21"
66
categories = ["format-injection"]
77
keywords = ["html", "xss"]
8+
aliases = ["GHSA-mm7x-qfjj-5g2c"]
89

910
[versions]
1011
patched = [">= 4.1.2", ">= 4.0.1, < 4.1.0", ">= 3.3.1, < 4.0.0"]

0 commit comments

Comments
 (0)