matteobovetti opened a new issue, #2213:
URL: https://github.com/apache/datafusion-ballista/issues/2213
Running a cargo audit with `cargo deny check advisories` I have discovered a
transitive security issue with `quick-xml` that require an upgrado of
`object_storage` from the actual version to `v0.14.1`.
Here the output of audit:
```
error[vulnerability]: Quadratic run time when checking a start tag for
duplicate attribute names
┌─ /Users/matteo.bovetti/git/hack/vaire-project/vairedb/Cargo.lock:330:1
│
330 │ quick-xml 0.39.4 registry+https://github.com/rust-lang/crates.io-index
│ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
security vulnerability detected
│
├ ID: RUSTSEC-2026-0194
├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0194
├ `BytesStart::attributes()` returns an `Attributes` iterator which, by
default
(`with_checks(true)`), rejects a start tag that repeats an attribute
name. For
each attribute yielded, the iterator compared the new name against
every name
seen so far in the same tag using a linear scan, so a start tag with
`N`
distinct attribute names cost `O(N²)` byte comparisons. There was no
bound on
`N` other than the size of the buffered start tag.
## Impact
Any code that parses untrusted XML and iterates a start tag's
attributes with
the default duplicate check enabled can be made to spend CPU time
quadratic in
the number of attributes on a single tag. Because the check is pure
computation
with no `.await`/I/O, an I/O-based timeout on the consumer (for
example a read
or request timeout) cannot interrupt it while it runs.
Measured cost of a single start tag, release build:
| Attributes on one tag | Time |
|---|---|
| 80,000 | ~6 s |
| 800,000 | ~10 min |
The cost grows with the square of the attribute count, so a start tag
of a few
tens of megabytes can stall a parsing thread for hours. No memory is
exhausted
and the parser does not crash; the effect is CPU exhaustion on the
thread doing
the parsing: a single crafted start tag can pin a CPU core for minutes
to hours,
denying service to that worker. A deployment that places a wall-clock
bound on
parsing, or confines it to a non-critical thread, may consider the
availability
impact lower.
## Affected code paths
* `BytesStart::attributes()` / `Attributes` iterated with checks
enabled (the
default), and `BytesStart::try_get_attribute`.
* `NsReader`, which resolves namespaces by iterating a tag's
attributes and so
reaches the same check internally.
Consumers that iterate attributes with
`.attributes().with_checks(false)` and do
not use `NsReader` are not affected.
This was reported as reachable by a remote, unauthenticated attacker
in a
real-world RPKI relying party (NLnet Labs Routinator) via a crafted
RRDP
`snapshot.xml`.
## Remediation
Upgrade to `quick-xml >= 0.41.0`, where the duplicate check keeps the
linear
scan for start tags with a small number of attributes and switches to
an `O(1)`
hash pre-filter above a threshold, making the whole tag `O(N)`. The
reported
`AttrError::Duplicated` positions are unchanged.
If upgrading is not possible and duplicate-name detection is not
required,
disable it with `.attributes().with_checks(false)` (this does not help
`NsReader` consumers, which have no equivalent opt-out before 0.41.0).
├ Announcement: https://github.com/tafia/quick-xml/issues/969
├ Solution: Upgrade to >=0.41.0 (try `cargo update -p quick-xml`)
├ quick-xml v0.39.4
└── object_store v0.13.2
├── ballista-core v53.0.0
│ ├── ballista-executor v53.0.0
│ │ └── vairedb-core v0.1.0
│ ├── ballista-scheduler v53.0.0
│ │ └── vairedb-coordinator v0.1.0
│ ├── vairedb-coordinator v0.1.0 (*)
│ └── vairedb-core v0.1.0 (*)
├── ballista-scheduler v53.0.0 (*)
├── datafusion v53.1.0
│ ├── arrow-pg v0.14.0
│ │ ├── datafusion-pg-catalog v0.17.3
│ │ │ └── vairedb-coordinator v0.1.0 (*)
│ │ └── vairedb-coordinator v0.1.0 (*)
│ ├── ballista-core v53.0.0 (*)
│ ├── ballista-executor v53.0.0 (*)
│ ├── ballista-scheduler v53.0.0 (*)
│ ├── datafusion-pg-catalog v0.17.3 (*)
│ ├── datafusion-substrait v53.1.0
│ │ └── ballista-scheduler v53.0.0 (*)
│ ├── vairedb-coordinator v0.1.0 (*)
│ └── vairedb-core v0.1.0 (*)
├── datafusion-catalog v53.1.0
│ ├── datafusion v53.1.0 (*)
│ ├── datafusion-catalog-listing v53.1.0
│ │ ├── datafusion v53.1.0 (*)
│ │ └── datafusion-proto v53.1.0
│ │ ├── ballista-core v53.0.0 (*)
│ │ ├── ballista-executor v53.0.0 (*)
│ │ ├── ballista-scheduler v53.0.0 (*)
│ │ ├── vairedb-coordinator v0.1.0 (*)
│ │ └── vairedb-core v0.1.0 (*)
│ ├── datafusion-functions-table v53.1.0
│ │ ├── datafusion v53.1.0 (*)
│ │ └── datafusion-proto v53.1.0 (*)
│ └── datafusion-proto v53.1.0 (*)
├── datafusion-catalog-listing v53.1.0 (*)
├── datafusion-common v53.1.0
│ ├── datafusion v53.1.0 (*)
│ ├── datafusion-catalog v53.1.0 (*)
│ ├── datafusion-catalog-listing v53.1.0 (*)
│ ├── datafusion-datasource v53.1.0
│ │ ├── datafusion v53.1.0 (*)
│ │ ├── datafusion-catalog v53.1.0 (*)
│ │ ├── datafusion-catalog-listing v53.1.0 (*)
│ │ ├── datafusion-datasource-arrow v53.1.0
│ │ │ ├── datafusion v53.1.0 (*)
│ │ │ └── datafusion-proto v53.1.0 (*)
│ │ ├── datafusion-datasource-csv v53.1.0
│ │ │ ├── datafusion v53.1.0 (*)
│ │ │ └── datafusion-proto v53.1.0 (*)
│ │ ├── datafusion-datasource-json v53.1.0
│ │ │ ├── datafusion v53.1.0 (*)
│ │ │ └── datafusion-proto v53.1.0 (*)
│ │ ├── datafusion-datasource-parquet v53.1.0
│ │ │ ├── datafusion v53.1.0 (*)
│ │ │ └── datafusion-proto v53.1.0 (*)
│ │ ├── datafusion-proto v53.1.0 (*)
│ │ └── datafusion-pruning v53.1.0
│ │ ├── datafusion-datasource-parquet v53.1.0 (*)
│ │ └── datafusion-physical-optimizer v53.1.0
│ │ └── datafusion v53.1.0 (*)
│ ├── datafusion-datasource-arrow v53.1.0 (*)
│ ├── datafusion-datasource-csv v53.1.0 (*)
│ ├── datafusion-datasource-json v53.1.0 (*)
│ ├── datafusion-datasource-parquet v53.1.0 (*)
│ ├── datafusion-execution v53.1.0
│ │ ├── datafusion v53.1.0 (*)
│ │ ├── datafusion-catalog v53.1.0 (*)
│ │ ├── datafusion-catalog-listing v53.1.0 (*)
│ │ ├── datafusion-datasource v53.1.0 (*)
│ │ ├── datafusion-datasource-arrow v53.1.0 (*)
│ │ ├── datafusion-datasource-csv v53.1.0 (*)
│ │ ├── datafusion-datasource-json v53.1.0 (*)
│ │ ├── datafusion-datasource-parquet v53.1.0 (*)
│ │ ├── datafusion-functions v53.1.0
│ │ │ ├── datafusion v53.1.0 (*)
│ │ │ ├── datafusion-functions-nested v53.1.0
│ │ │ │ ├── datafusion v53.1.0 (*)
│ │ │ │ └── datafusion-sql v53.1.0
│ │ │ │ └── datafusion v53.1.0 (*)
│ │ │ ├── datafusion-physical-expr-adapter v53.1.0
│ │ │ │ ├── datafusion v53.1.0 (*)
│ │ │ │ ├── datafusion-catalog-listing v53.1.0 (*)
│ │ │ │ ├── datafusion-datasource v53.1.0 (*)
│ │ │ │ └── datafusion-datasource-parquet v53.1.0 (*)
│ │ │ └── datafusion-physical-plan v53.1.0
│ │ │ ├── datafusion v53.1.0 (*)
│ │ │ ├── datafusion-catalog v53.1.0 (*)
│ │ │ ├── datafusion-catalog-listing v53.1.0 (*)
│ │ │ ├── datafusion-datasource v53.1.0 (*)
│ │ │ ├── datafusion-datasource-arrow v53.1.0 (*)
│ │ │ ├── datafusion-datasource-csv v53.1.0 (*)
│ │ │ ├── datafusion-datasource-json v53.1.0 (*)
│ │ │ ├── datafusion-datasource-parquet v53.1.0 (*)
│ │ │ ├── datafusion-functions-table v53.1.0 (*)
│ │ │ ├── datafusion-physical-optimizer v53.1.0 (*)
│ │ │ ├── datafusion-proto v53.1.0 (*)
│ │ │ ├── datafusion-pruning v53.1.0 (*)
│ │ │ └── datafusion-session v53.1.0
│ │ │ ├── datafusion v53.1.0 (*)
│ │ │ ├── datafusion-catalog v53.1.0 (*)
│ │ │ ├── datafusion-datasource v53.1.0 (*)
│ │ │ ├── datafusion-datasource-arrow v53.1.0 (*)
│ │ │ ├── datafusion-datasource-csv v53.1.0 (*)
│ │ │ ├── datafusion-datasource-json v53.1.0 (*)
│ │ │ └── datafusion-datasource-parquet v53.1.0 (*)
│ │ ├── datafusion-functions-aggregate v53.1.0
│ │ │ ├── datafusion v53.1.0 (*)
│ │ │ └── datafusion-functions-nested v53.1.0 (*)
│ │ ├── datafusion-functions-nested v53.1.0 (*)
│ │ ├── datafusion-physical-optimizer v53.1.0 (*)
│ │ ├── datafusion-physical-plan v53.1.0 (*)
│ │ ├── datafusion-proto v53.1.0 (*)
│ │ └── datafusion-session v53.1.0 (*)
│ ├── datafusion-expr v53.1.0
│ │ ├── datafusion v53.1.0 (*)
│ │ ├── datafusion-catalog v53.1.0 (*)
│ │ ├── datafusion-catalog-listing v53.1.0 (*)
│ │ ├── datafusion-datasource v53.1.0 (*)
│ │ ├── datafusion-datasource-arrow v53.1.0 (*)
│ │ ├── datafusion-datasource-csv v53.1.0 (*)
│ │ ├── datafusion-datasource-json v53.1.0 (*)
│ │ ├── datafusion-datasource-parquet v53.1.0 (*)
│ │ ├── datafusion-execution v53.1.0 (*)
│ │ ├── datafusion-functions v53.1.0 (*)
│ │ ├── datafusion-functions-aggregate v53.1.0 (*)
│ │ ├── datafusion-functions-nested v53.1.0 (*)
│ │ ├── datafusion-functions-table v53.1.0 (*)
│ │ ├── datafusion-functions-window v53.1.0
│ │ │ └── datafusion v53.1.0 (*)
│ │ ├── datafusion-optimizer v53.1.0
│ │ │ └── datafusion v53.1.0 (*)
│ │ ├── datafusion-physical-expr v53.1.0
│ │ │ ├── datafusion v53.1.0 (*)
│ │ │ ├── datafusion-catalog v53.1.0 (*)
│ │ │ ├── datafusion-catalog-listing v53.1.0 (*)
│ │ │ ├── datafusion-datasource v53.1.0 (*)
│ │ │ ├── datafusion-datasource-parquet v53.1.0 (*)
│ │ │ ├── datafusion-functions-aggregate v53.1.0 (*)
│ │ │ ├── datafusion-functions-window v53.1.0 (*)
│ │ │ ├── datafusion-optimizer v53.1.0 (*)
│ │ │ ├── datafusion-physical-expr-adapter v53.1.0 (*)
│ │ │ ├── datafusion-physical-optimizer v53.1.0 (*)
│ │ │ ├── datafusion-physical-plan v53.1.0 (*)
│ │ │ ├── datafusion-proto v53.1.0 (*)
│ │ │ └── datafusion-pruning v53.1.0 (*)
│ │ ├── datafusion-physical-expr-adapter v53.1.0 (*)
│ │ ├── datafusion-physical-optimizer v53.1.0 (*)
│ │ ├── datafusion-physical-plan v53.1.0 (*)
│ │ ├── datafusion-proto v53.1.0 (*)
│ │ ├── datafusion-session v53.1.0 (*)
│ │ └── datafusion-sql v53.1.0 (*)
│ ├── datafusion-expr-common v53.1.0
│ │ ├── datafusion v53.1.0 (*)
│ │ ├── datafusion-expr v53.1.0 (*)
│ │ ├── datafusion-functions v53.1.0 (*)
│ │ ├── datafusion-functions-aggregate-common v53.1.0
│ │ │ ├── datafusion-datasource-parquet v53.1.0 (*)
│ │ │ ├── datafusion-expr v53.1.0 (*)
│ │ │ ├── datafusion-functions-aggregate v53.1.0 (*)
│ │ │ ├── datafusion-functions-nested v53.1.0 (*)
│ │ │ ├── datafusion-physical-expr v53.1.0 (*)
│ │ │ └── datafusion-physical-plan v53.1.0 (*)
│ │ ├── datafusion-functions-nested v53.1.0 (*)
│ │ ├── datafusion-optimizer v53.1.0 (*)
│ │ ├── datafusion-physical-expr v53.1.0 (*)
│ │ ├── datafusion-physical-expr-common v53.1.0
│ │ │ ├── datafusion v53.1.0 (*)
│ │ │ ├── datafusion-catalog-listing v53.1.0 (*)
│ │ │ ├── datafusion-datasource v53.1.0 (*)
│ │ │ ├── datafusion-datasource-arrow v53.1.0 (*)
│ │ │ ├── datafusion-datasource-csv v53.1.0 (*)
│ │ │ ├── datafusion-datasource-json v53.1.0 (*)
│ │ │ ├── datafusion-datasource-parquet v53.1.0 (*)
│ │ │ ├── datafusion-execution v53.1.0 (*)
│ │ │ ├── datafusion-expr v53.1.0 (*)
│ │ │ ├── datafusion-functions-aggregate v53.1.0 (*)
│ │ │ ├── datafusion-functions-aggregate-common v53.1.0 (*)
│ │ │ ├── datafusion-functions-nested v53.1.0 (*)
│ │ │ ├── datafusion-functions-window v53.1.0 (*)
│ │ │ ├── datafusion-functions-window-common v53.1.0
│ │ │ │ ├── datafusion-expr v53.1.0 (*)
│ │ │ │ ├── datafusion-functions-window v53.1.0 (*)
│ │ │ │ └── datafusion-physical-plan v53.1.0 (*)
│ │ │ ├── datafusion-physical-expr v53.1.0 (*)
│ │ │ ├── datafusion-physical-expr-adapter v53.1.0 (*)
│ │ │ ├── datafusion-physical-optimizer v53.1.0 (*)
│ │ │ ├── datafusion-physical-plan v53.1.0 (*)
│ │ │ ├── datafusion-proto v53.1.0 (*)
│ │ │ └── datafusion-pruning v53.1.0 (*)
│ │ ├── datafusion-physical-optimizer v53.1.0 (*)
│ │ └── datafusion-pruning v53.1.0 (*)
│ ├── datafusion-functions v53.1.0 (*)
│ ├── datafusion-functions-aggregate v53.1.0 (*)
│ ├── datafusion-functions-aggregate-common v53.1.0 (*)
│ ├── datafusion-functions-nested v53.1.0 (*)
│ ├── datafusion-functions-table v53.1.0 (*)
│ ├── datafusion-functions-window v53.1.0 (*)
│ ├── datafusion-functions-window-common v53.1.0 (*)
│ ├── datafusion-optimizer v53.1.0 (*)
│ ├── datafusion-physical-expr v53.1.0 (*)
│ ├── datafusion-physical-expr-adapter v53.1.0 (*)
│ ├── datafusion-physical-expr-common v53.1.0 (*)
│ ├── datafusion-physical-optimizer v53.1.0 (*)
│ ├── datafusion-physical-plan v53.1.0 (*)
│ ├── datafusion-proto v53.1.0 (*)
│ ├── datafusion-proto-common v53.1.0
│ │ ├── ballista-core v53.0.0 (*)
│ │ └── datafusion-proto v53.1.0 (*)
│ ├── datafusion-pruning v53.1.0 (*)
│ ├── datafusion-session v53.1.0 (*)
│ └── datafusion-sql v53.1.0 (*)
├── datafusion-datasource v53.1.0 (*)
├── datafusion-datasource-arrow v53.1.0 (*)
├── datafusion-datasource-csv v53.1.0 (*)
├── datafusion-datasource-json v53.1.0 (*)
├── datafusion-datasource-parquet v53.1.0 (*)
├── datafusion-execution v53.1.0 (*)
├── datafusion-proto v53.1.0 (*)
├── datafusion-substrait v53.1.0 (*)
└── parquet v58.3.0
├── datafusion v53.1.0 (*)
├── datafusion-common v53.1.0 (*)
└── datafusion-datasource-parquet v53.1.0 (*)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
