update: clean cargo-audit by removing atty and pinning rsa advisory#198
Merged
update: clean cargo-audit by removing atty and pinning rsa advisory#198
Conversation
Resolves all cargo-audit findings reported on deps.rs.
Replace the unmaintained `atty` crate with `std::io::IsTerminal` (stdlib since Rust 1.70). This drops two advisories at once: RUSTSEC-2024-0375 (unmaintained) and RUSTSEC-2021-0145 (unsound unaligned read). The five call sites in pty, logging, ssh::auth, and the interactive connection now go through `std::io::{stdin, stdout}().is_terminal()`.
Run `cargo update` to pick up 33 transitive patch bumps available within current semver constraints (tokio 1.52.1 -> 1.52.3, rustls 0.23.39 -> 0.23.40, h2 0.4.13 -> 0.4.14, digest 0.11.2 -> 0.11.3, rpassword 7.4.0 -> 7.5.2, and others). The Cargo.lock churn is mostly transitive; no direct `[dependencies]` constraints needed loosening except the atty removal.
Add `.cargo/audit.toml` ignoring RUSTSEC-2023-0071 (Marvin Attack) with an explanatory comment. Both `rsa 0.9.10` (via ssh-key 0.6.x) and `rsa 0.10.0-rc.17` (via the vendored bssh-russh fork) are affected, and no fixed upstream version exists for any rsa release. Bumping to 0.10.0-rc.18 conflicts with the bssh-russh `pkcs5 = "=0.8.0-rc.13"` pin, so we accept the advisory at the audit layer and document Ed25519/ECDSA as the recommended mitigation for users.
Verified: `cargo audit` reports 0 vulnerabilities / 0 warnings, `cargo clippy -- -D warnings` is clean, `cargo test --lib` passes (1222/1222), `cargo fmt --check` is clean.
inureyes
added
status:review
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves all
cargo-auditfindings reported on deps.rs so the audit job returns a clean tree (0 vulnerabilities / 0 warnings).Changes
1. Replace unmaintained
attywithstd::io::IsTerminalRUSTSEC-2024-0375—attyis unmaintainedRUSTSEC-2021-0145—attypotential unaligned read (unsound)std::io::{stdin, stdout}().is_terminal()in:src/pty/mod.rssrc/utils/logging.rssrc/ssh/auth.rssrc/commands/interactive/connection.rsatty = "0.2.14"removed fromCargo.toml.2. Transitive patch bumps via
cargo update33 packages updated within existing semver constraints. Highlights:
3. Document
RUSTSEC-2023-0071(Marvin Attack) in.cargo/audit.tomlThe Marvin Attack timing sidechannel affects:
rsa 0.9.10(viassh-key 0.6.x)rsa 0.10.0-rc.17(via the vendoredbssh-russhfork)No fixed upstream release exists for any version of the
rsacrate. Bumping to0.10.0-rc.18conflicts withbssh-russh'spkcs5 = "=0.8.0-rc.13"pin. The advisory is accepted at the audit layer with a comment recommending Ed25519/ECDSA keys as the practical mitigation; tracking RustCrypto/RSA#19.What deps.rs flagged but was a false positive
<0.4.20; current version unaffected<1.18.5/ other old branches; current unaffectedcargo-audit's advisory DB; out of scopeTest plan
cargo fmt --checkcleancargo clippy -- -D warningscleancargo test --lib— 1222 passed / 0 failedcargo audit— 0 vulnerabilities, 0 warnings