SeaQL/sea-orm

Vulnerability in the `rsa` (a recursive dependency of SeaORM)

Opened this issue · 2 comments

baraknaveh commented

Description

Dependabot complains on a vulnerability in rsa, a recursive dependency of SeaORM. This is a link to the issue: https://rustsec.org/advisories/RUSTSEC-2023-0071.html

Vulnerability location:

├── sea-orm v0.12.15
│   ├── sea-query-binder v0.5.0
│   │   ├── sqlx v0.7.4
│   │   │   ├── sqlx-mysql v0.7.4
│   │   │   │   ├── rsa v0.9.6       <-- Vulnerable

Steps to Reproduce

Run GitHub dependabot on the codebase.

Expected Behavior

No vulnerabilities

Actual Behavior

https://rustsec.org/advisories/RUSTSEC-2023-0071.html

Reproduces How Often

Always

Workarounds

🤷‍♂️

Reproducible Example

Marvin Attack Vulnerability

Versions

v0.12.15

Expurple commented

Workarounds

🤷‍♂️

I believe, it should be possible to patch rsa to a compatible version with a security fix or patch sqlx-mysql to a compatible version that replaces rsa with another crate (if it's even possible?). Consider linking these versions, if they exist.

  • 👍1
ogtn commented

Looking at the discussion on the RSA repo here RustCrypto/RSA#19, I'm not sure we can exect a fix in a short term.

The annoying thing is that it combines with a Cargo bug (#2172), so this vulnerability is reported by dependabot even when not using mysql.

  • 👍1