multiple CVEs

[mcandre]

Hi,

cargo audit has identified a vulnerability in the msix crate, via the xcommon (potentially transitive) dependency.

$ cat Cargo.toml
[package]
name = "pizzarat"
description = "the scrappy package generator"
version = "0.0.1"
edition = "2024"
authors = ["Andrew Pennebaker <n4jm4@pm.me>"]
license = "0BSD"
repository = "https://github.com/mcandre/pizzarat"

[dependencies]
apple-bom = "0.3.0"
apple-flat-package = "0.20.0"
cpio-archive = "0.10.0"
deb-rust = "0.1.2"
die = "0.2.0"
flate2 = "1.1.8"
getopts = "0.2.24"
libarchive2 = "0.2.1"
msix = "0.4.0"
serde = { version = "1.0.228", features = ["derive"] }
serde-xml-rs = "0.8.2"
tempfile = "3.24.0"
toml = "0.9.8"
xcommon = "0.3.0"

[lib]
name = "pizzarat"

[[bin]]
name = "pizzarat"
path = "src/pizzarat.rs"

$ cargo install cargo-audit

$ cargo audit
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 902 security advisories (from /Users/andrew/.asdf/installs/rust/1.92.0/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (312 crate dependencies)
Crate:     rsa
Version:   0.7.2
Title:     Marvin Attack: potential key recovery through timing sidechannels
Date:      2023-11-22
ID:        RUSTSEC-2023-0071
URL:       https://rustsec.org/advisories/RUSTSEC-2023-0071
Severity:  5.9 (medium)
Solution:  No fixed upgrade is available!
Dependency tree:
rsa 0.7.2
└── xcommon 0.3.0
    ├── pizzarat 0.0.1
    └── msix 0.4.0
        └── pizzarat 0.0.1

Crate:     rsa
Version:   0.9.10
Title:     Marvin Attack: potential key recovery through timing sidechannels
Date:      2023-11-22
ID:        RUSTSEC-2023-0071
URL:       https://rustsec.org/advisories/RUSTSEC-2023-0071
Severity:  5.9 (medium)
Solution:  No fixed upgrade is available!
Dependency tree:
rsa 0.9.10
└── zar 0.1.4
    └── pizzarat 0.0.1

error: 2 vulnerabilities found!

Please publish a patched release version of msix that does not contain this vulnerability. For example, update or replace the xcommon crate.

[mcandre]

Cloning the source reveals even more vulnerabilities.

Migrated to rsa 0.9.10.

7 vulnerabilities remain:

% cargo install cargo-audit
% cargo audit
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 903 security advisories (from /Users/andrew/.asdf/installs/rust/1.92.0/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (488 crate dependencies)
Crate:     curve25519-dalek
Version:   3.2.0
Title:     Timing variability in `curve25519-dalek`'s `Scalar29::sub`/`Scalar52::sub`
Date:      2024-06-18
ID:        RUSTSEC-2024-0344
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0344
Solution:  Upgrade to >=4.1.3
Dependency tree:
curve25519-dalek 3.2.0
└── spake2 0.3.1
    └── apple-codesign 0.22.0
        └── appbundle 0.3.0
            └── xbuild 0.2.0

Crate:     ring
Version:   0.16.20
Title:     Some AES functions may panic when overflow checking is enabled.
Date:      2025-03-06
ID:        RUSTSEC-2025-0009
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0009
Solution:  Upgrade to >=0.17.12
Dependency tree:
ring 0.16.20
├── x509-certificate 0.16.0
│   ├── cryptographic-message-syntax 0.19.0
│   │   ├── apple-xar 0.13.0
│   │   │   ├── apple-flat-package 0.13.0
│   │   │   │   └── apple-codesign 0.22.0
│   │   │   │       └── appbundle 0.3.0
│   │   │   │           └── xbuild 0.2.0
│   │   │   └── apple-codesign 0.22.0
│   │   └── apple-codesign 0.22.0
│   ├── apple-xar 0.13.0
│   ├── apple-codesign 0.22.0
│   ├── appbundle 0.3.0
│   └── app-store-connect 0.1.0
│       ├── xbuild 0.2.0
│       └── apple-codesign 0.22.0
├── rustls 0.20.9
│   ├── tungstenite 0.18.0
│   │   └── apple-codesign 0.22.0
│   ├── tokio-rustls 0.23.4
│   │   └── hyper-rustls 0.23.2
│   │       └── aws-smithy-client 0.52.0
│   │           ├── aws-types 0.52.0
│   │           │   ├── aws-sig-auth 0.52.0
│   │           │   │   ├── aws-sdk-sts 0.22.0
│   │           │   │   │   └── aws-config 0.52.0
│   │           │   │   │       └── apple-codesign 0.22.0
│   │           │   │   ├── aws-sdk-sso 0.22.0
│   │           │   │   │   └── aws-config 0.52.0
│   │           │   │   └── aws-sdk-s3 0.22.0
│   │           │   │       └── apple-codesign 0.22.0
│   │           │   ├── aws-sdk-sts 0.22.0
│   │           │   ├── aws-sdk-sso 0.22.0
│   │           │   ├── aws-sdk-s3 0.22.0
│   │           │   ├── aws-http 0.52.0
│   │           │   │   ├── aws-sdk-sts 0.22.0
│   │           │   │   ├── aws-sdk-sso 0.22.0
│   │           │   │   ├── aws-sdk-s3 0.22.0
│   │           │   │   └── aws-config 0.52.0
│   │           │   ├── aws-endpoint 0.52.0
│   │           │   │   ├── aws-sdk-sts 0.22.0
│   │           │   │   ├── aws-sdk-sso 0.22.0
│   │           │   │   └── aws-sdk-s3 0.22.0
│   │           │   └── aws-config 0.52.0
│   │           ├── aws-sdk-sts 0.22.0
│   │           ├── aws-sdk-sso 0.22.0
│   │           ├── aws-sdk-s3 0.22.0
│   │           └── aws-config 0.52.0
│   └── hyper-rustls 0.23.2
├── jsonwebtoken 8.3.0
│   └── app-store-connect 0.1.0
├── cryptographic-message-syntax 0.19.0
├── aws-config 0.52.0
└── apple-codesign 0.22.0

Crate:     rsa
Version:   0.7.2
Title:     Marvin Attack: potential key recovery through timing sidechannels
Date:      2023-11-22
ID:        RUSTSEC-2023-0071
URL:       https://rustsec.org/advisories/RUSTSEC-2023-0071
Severity:  5.9 (medium)
Solution:  No fixed upgrade is available!
Dependency tree:
rsa 0.7.2
├── apple-codesign 0.22.0
│   └── appbundle 0.3.0
│       └── xbuild 0.2.0
└── app-store-connect 0.1.0
    ├── xbuild 0.2.0
    └── apple-codesign 0.22.0

Crate:     rsa
Version:   0.9.10
Title:     Marvin Attack: potential key recovery through timing sidechannels
Date:      2023-11-22
ID:        RUSTSEC-2023-0071
URL:       https://rustsec.org/advisories/RUSTSEC-2023-0071
Severity:  5.9 (medium)
Solution:  No fixed upgrade is available!
Dependency tree:
rsa 0.9.10
├── xcommon 0.3.0
│   ├── xbuild 0.2.0
│   ├── mvn 0.2.0
│   │   └── xbuild 0.2.0
│   ├── msix 0.4.0
│   │   └── xbuild 0.2.0
│   ├── appimage 0.4.0
│   │   └── xbuild 0.2.0
│   ├── appbundle 0.3.0
│   │   └── xbuild 0.2.0
│   └── apk 0.4.0
│       └── xbuild 0.2.0
├── msix 0.4.0
└── apk 0.4.0

Crate:     rustls
Version:   0.20.9
Title:     `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input
Date:      2024-04-19
ID:        RUSTSEC-2024-0336
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0336
Severity:  7.5 (high)
Solution:  Upgrade to >=0.23.5 OR >=0.22.4, <0.23.0 OR >=0.21.11, <0.22.0
Dependency tree:
rustls 0.20.9
├── tungstenite 0.18.0
│   └── apple-codesign 0.22.0
│       └── appbundle 0.3.0
│           └── xbuild 0.2.0
├── tokio-rustls 0.23.4
│   └── hyper-rustls 0.23.2
│       └── aws-smithy-client 0.52.0
│           ├── aws-types 0.52.0
│           │   ├── aws-sig-auth 0.52.0
│           │   │   ├── aws-sdk-sts 0.22.0
│           │   │   │   └── aws-config 0.52.0
│           │   │   │       └── apple-codesign 0.22.0
│           │   │   ├── aws-sdk-sso 0.22.0
│           │   │   │   └── aws-config 0.52.0
│           │   │   └── aws-sdk-s3 0.22.0
│           │   │       └── apple-codesign 0.22.0
│           │   ├── aws-sdk-sts 0.22.0
│           │   ├── aws-sdk-sso 0.22.0
│           │   ├── aws-sdk-s3 0.22.0
│           │   ├── aws-http 0.52.0
│           │   │   ├── aws-sdk-sts 0.22.0
│           │   │   ├── aws-sdk-sso 0.22.0
│           │   │   ├── aws-sdk-s3 0.22.0
│           │   │   └── aws-config 0.52.0
│           │   ├── aws-endpoint 0.52.0
│           │   │   ├── aws-sdk-sts 0.22.0
│           │   │   ├── aws-sdk-sso 0.22.0
│           │   │   └── aws-sdk-s3 0.22.0
│           │   └── aws-config 0.52.0
│           ├── aws-sdk-sts 0.22.0
│           ├── aws-sdk-sso 0.22.0
│           ├── aws-sdk-s3 0.22.0
│           └── aws-config 0.52.0
└── hyper-rustls 0.23.2

Crate:     time
Version:   0.1.45
Title:     Potential segfault in the time crate
Date:      2020-11-18
ID:        RUSTSEC-2020-0071
URL:       https://rustsec.org/advisories/RUSTSEC-2020-0071
Severity:  6.2 (medium)
Solution:  Upgrade to >=0.2.23
Dependency tree:
time 0.1.45
└── zip 0.5.13
    └── android-sdkmanager-rs 0.5.0
        └── xbuild 0.2.0

Crate:     tungstenite
Version:   0.18.0
Title:     Tungstenite allows remote attackers to cause a denial of service
Date:      2023-09-25
ID:        RUSTSEC-2023-0065
URL:       https://rustsec.org/advisories/RUSTSEC-2023-0065
Severity:  7.5 (high)
Solution:  Upgrade to >=0.20.1
Dependency tree:
tungstenite 0.18.0
└── apple-codesign 0.22.0
    └── appbundle 0.3.0
        └── xbuild 0.2.0

Crate:     difference
Version:   2.0.0
Warning:   unmaintained
Title:     difference is unmaintained
Date:      2020-12-20
ID:        RUSTSEC-2020-0095
URL:       https://rustsec.org/advisories/RUSTSEC-2020-0095
Dependency tree:
difference 2.0.0
└── apple-codesign 0.22.0
    └── appbundle 0.3.0
        └── xbuild 0.2.0

Crate:     instant
Version:   0.1.13
Warning:   unmaintained
Title:     `instant` is unmaintained
Date:      2024-09-01
ID:        RUSTSEC-2024-0384
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0384
Dependency tree:
instant 0.1.13
└── fastrand 1.9.0
    ├── aws-smithy-client 0.52.0
    │   ├── aws-types 0.52.0
    │   │   ├── aws-sig-auth 0.52.0
    │   │   │   ├── aws-sdk-sts 0.22.0
    │   │   │   │   └── aws-config 0.52.0
    │   │   │   │       └── apple-codesign 0.22.0
    │   │   │   │           └── appbundle 0.3.0
    │   │   │   │               └── xbuild 0.2.0
    │   │   │   ├── aws-sdk-sso 0.22.0
    │   │   │   │   └── aws-config 0.52.0
    │   │   │   └── aws-sdk-s3 0.22.0
    │   │   │       └── apple-codesign 0.22.0
    │   │   ├── aws-sdk-sts 0.22.0
    │   │   ├── aws-sdk-sso 0.22.0
    │   │   ├── aws-sdk-s3 0.22.0
    │   │   ├── aws-http 0.52.0
    │   │   │   ├── aws-sdk-sts 0.22.0
    │   │   │   ├── aws-sdk-sso 0.22.0
    │   │   │   ├── aws-sdk-s3 0.22.0
    │   │   │   └── aws-config 0.52.0
    │   │   ├── aws-endpoint 0.52.0
    │   │   │   ├── aws-sdk-sts 0.22.0
    │   │   │   ├── aws-sdk-sso 0.22.0
    │   │   │   └── aws-sdk-s3 0.22.0
    │   │   └── aws-config 0.52.0
    │   ├── aws-sdk-sts 0.22.0
    │   ├── aws-sdk-sso 0.22.0
    │   ├── aws-sdk-s3 0.22.0
    │   └── aws-config 0.52.0
    └── aws-sdk-s3 0.22.0

Crate:     number_prefix
Version:   0.4.0
Warning:   unmaintained
Title:     number_prefix crate is unmaintained
Date:      2025-11-17
ID:        RUSTSEC-2025-0119
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0119
Dependency tree:
number_prefix 0.4.0
└── indicatif 0.17.11
    └── xbuild 0.2.0

Crate:     ring
Version:   0.16.20
Warning:   unmaintained
Title:     Versions of *ring* prior to 0.17 are unmaintained.
Date:      2025-03-05
ID:        RUSTSEC-2025-0010
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0010

Crate:     rustls-pemfile
Version:   1.0.4
Warning:   unmaintained
Title:     rustls-pemfile is unmaintained
Date:      2025-11-28
ID:        RUSTSEC-2025-0134
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0134
Dependency tree:
rustls-pemfile 1.0.4
├── rustls-native-certs 0.6.3
│   ├── tungstenite 0.18.0
│   │   └── apple-codesign 0.22.0
│   │       └── appbundle 0.3.0
│   │           └── xbuild 0.2.0
│   └── hyper-rustls 0.23.2
│       └── aws-smithy-client 0.52.0
│           ├── aws-types 0.52.0
│           │   ├── aws-sig-auth 0.52.0
│           │   │   ├── aws-sdk-sts 0.22.0
│           │   │   │   └── aws-config 0.52.0
│           │   │   │       └── apple-codesign 0.22.0
│           │   │   ├── aws-sdk-sso 0.22.0
│           │   │   │   └── aws-config 0.52.0
│           │   │   └── aws-sdk-s3 0.22.0
│           │   │       └── apple-codesign 0.22.0
│           │   ├── aws-sdk-sts 0.22.0
│           │   ├── aws-sdk-sso 0.22.0
│           │   ├── aws-sdk-s3 0.22.0
│           │   ├── aws-http 0.52.0
│           │   │   ├── aws-sdk-sts 0.22.0
│           │   │   ├── aws-sdk-sso 0.22.0
│           │   │   ├── aws-sdk-s3 0.22.0
│           │   │   └── aws-config 0.52.0
│           │   ├── aws-endpoint 0.52.0
│           │   │   ├── aws-sdk-sts 0.22.0
│           │   │   ├── aws-sdk-sso 0.22.0
│           │   │   └── aws-sdk-s3 0.22.0
│           │   └── aws-config 0.52.0
│           ├── aws-sdk-sts 0.22.0
│           ├── aws-sdk-sso 0.22.0
│           ├── aws-sdk-s3 0.22.0
│           └── aws-config 0.52.0
└── reqwest 0.11.27
    ├── xbuild 0.2.0
    ├── cryptographic-message-syntax 0.19.0
    │   ├── apple-xar 0.13.0
    │   │   ├── apple-flat-package 0.13.0
    │   │   │   └── apple-codesign 0.22.0
    │   │   └── apple-codesign 0.22.0
    │   └── apple-codesign 0.22.0
    ├── apple-xar 0.13.0
    ├── apple-codesign 0.22.0
    └── app-store-connect 0.1.0
        ├── xbuild 0.2.0
        └── apple-codesign 0.22.0

error: 7 vulnerabilities found!
warning: 5 allowed warnings found