Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump rustls form 0.21.7 to 0.21.11 #3967

Merged
merged 1 commit into from
Apr 23, 2024
Merged

Conversation

nick-mobilecoin
Copy link
Collaborator

@nick-mobilecoin nick-mobilecoin commented Apr 22, 2024

Bumping rustls from 0.21.7 to 0.21.11 to mitigate, https://rustsec.org/advisories/RUSTSEC-2024-0336
Unfortunately due to mc-ledger-distribution using rusoto it is still using a version of rustls that is susceptible to RUSTSEC-2024-0336

cargo tree -i -p [email protected]
rustls v0.20.7
├── hyper-rustls v0.23.2
│   └── rusoto_core v0.48.0
│       ├── mc-ledger-distribution v6.0.0 (/Users/nick/git/mobilecoin/ledger/distribution)
│       └── rusoto_s3 v0.48.0
│           └── mc-ledger-distribution v6.0.0 (/Users/nick/git/mobilecoin/ledger/distribution)
└── tokio-rustls v0.23.4
    └── hyper-rustls v0.23.2 (*)

rusoto is unmaintained and we should probably look at moving toward https://github.com/awslabs/aws-sdk-rust

@nick-mobilecoin nick-mobilecoin changed the base branch from main to release/v6.0 April 22, 2024 16:16
@nick-mobilecoin nick-mobilecoin changed the title nick/update rustls Bump rustls form 0.21.7 to 0.21.11 Apr 22, 2024
Copy link

⚠️ Downstream repo mobilecoinofficial/android-bindings failed to build. Check actions status for details.

Copy link

⚠️ Downstream repo mobilecoinofficial/full-service failed to build. Check actions status for details.

@nick-mobilecoin nick-mobilecoin merged commit 39e9264 into release/v6.0 Apr 23, 2024
21 checks passed
@nick-mobilecoin nick-mobilecoin deleted the nick/update-rustls branch April 23, 2024 02:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants