Bug#986808: CVE-2021-29939

2021-04-12 Thread peter green

On 12/04/2021 23:54, peter green wrote:

Hi.

The stackvector crate does not appear to be maintained upstream. The upstream 
bug underlying this
issue was reported back in February and has received no response from the 
upstream maintainer.


Update: the upstream maintainer has now responded to the bug with a tentative 
fix and plans to
release it soon. Unless there are objections, If/when he does so I will apply 
it to the Debian
package and upload. Afterwards (but not before the current version of 
rust-sniffglue has migrated
to testing) I will request a binnmu of rust-sniffglue (which appears to be the 
only application
built against rust-stackvector) to pick up the fix.



Bug#986808: CVE-2021-29939

2021-04-12 Thread peter green

Hi.

The stackvector crate does not appear to be maintained upstream. The upstream 
bug underlying this
issue was reported back in February and has received no response from the 
upstream maintainer.

It seems the only user of the stackvector crate in Debian is the lexical_core 
crate.
The lexical_core crate upstream (which appears to be the same person as the 
stackvector maintainer)
switched from stackvector to arrayvec some time ago. The relavent commit on the 
0.4 branch being
https://github.com/Alexhuszagh/rust-lexical/commit/6f9f3f5b9232107791008098012ef5fa069a

Regarding the actual bug, I think it can be fixed by simply changing "while count < 
lower_bound {"
to "while count < upper_bound {" but I'm no expert on the code and I'm 
reluctant to apply it
without some feedback from someone more familiar with the code.

That patch patches to use arrayvec 0.4 which is lower than the version 0.5 in 
Debian, but looking
at the master branch I suspect that it will be a simple case of just bumping 
the dependency.

So it seems there are a few possible ways forward here.

1. Try and fix stackvector ourselves, this is the smaller change but as I said 
i'm reluctant
   to do it without more eyes on the code.
2. Apply the upstream commit to switch lexical_core to arrayvec and then bump 
the arrayvec
   dependency to 0.5. We would also likely have to either use feature_collapse 
or manually
   alter debian/control to avoid getting stuck in new. This is a more intrusive 
change but
   leaves us closer to upstream. stackvector can then be removed.

Thoughts?



Bug#986808: CVE-2021-29939

2021-04-12 Thread Moritz Muehlenhoff
Source: rust-stackvector
Severity: grave
Tags: security
X-Debbugs-Cc: Debian Security Team 

https://rustsec.org/advisories/RUSTSEC-2021-0048.html

Cheers,
Moritz