advisory-db
webpki
Our great sponsors
advisory-db | webpki | |
---|---|---|
37 | 6 | |
856 | 451 | |
4.3% | - | |
9.2 | 8.0 | |
5 days ago | 2 months ago | |
Rust | ||
GNU General Public License v3.0 or later | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
advisory-db
- Serde-YAML for Rust has been archived
- When Zig is safer and faster than Rust
-
Advisory: Miscompilation in cortex-m-rt 0.7.1 and 0.7.2
You might also want to add this to https://github.com/rustsec/advisory-db so that cargo audit and Dependabot surface it.
-
"This type of secure-by-default functionality is why we love Go"
The behavior of not extracting outside the specified directory has been the default since forever in Rust's tar. And then it had two RUSTSEC advisories for not handling this correctly in certain corner cases. The latest one in 2021.
-
greater supply chain attack risk due to large dependency trees?
cargo-audit only checks for known issues reported to a vulnerability database.
- capnproto-rust: out-of-bound memory access bug
-
`cargo audit` can now scan compiled binaries
However, I keep getting this error when running cargo audit bin ~/.cargo/bin/*, even if I replace * with a specific binary: Fetching advisory database from `https://github.com/RustSec/advisory-db.git` Loaded 467 security advisories (from C:\Users\jonah\.cargo\advisory-db) Updating crates.io index error: I/O operation failed: The system cannot find the path specified. (os error 3) I'm on Windows 10.
-
MIA Github Assignee on very minor PR
I usually open an issue asking if the crate is still maintained. If there isn't a response for a decent amount of time (like multiple months) and the crate is somewhat popular then it could be worth opening an unmaintained advisory in the advisory-db
-
RustSec Advisory Database Visualization
Here is the visualization of RustSec Advisory Database. I hope it will be helpful. If you need any more charts, feel free to comment.
-
Github Dependency graph adds vulnerability alerting support for Rust
FWIW the RustSec database is still not synced into the Github databse on a regular basis, even though they did an initial import of it. So the cargo audit github action is still relevant.
webpki
-
Struggling with the OpenSSL Crate
Beyond that, various things like the ScyllaDB driver are using OpenSSL because WebPKI doesn't support validating connections to IP addresses (as opposed to DNS names) and RusTLS currently delegates to WebPKI.
-
What Is Rust's Hole Purpose?
There's a JIT framework in Rust: https://github.com/bytecodealliance/wasmtime
There's a library for doing full X.509 certificate parsing and verification: https://briansmith.org/rustdoc/webpki/
There's definitely some attempts at doing pure-Rust SSL, but I suspect a lot of them are also doing some sketchy things with crypto that shouldn't be trusted (getting constant-time stuff implemented properly is really challenging, and probably requires large amounts of assembly to guarantee correctness).
-
I think a major issue with the rust ecosystem is that it's full of unexpected design decisions
An issue was raised with webpki to support the IP addressees 5 years ago, and yet it's still not there. What do people use to overcome the fact that rustls can't do IP-based client connections because of it? My guess would be, they are switching to native-tls or openssl-tls.
-
Why is SSL such a pain?
Yes, rustls currently doesn't support certificates without hostnames (only an IP); this is actually an issue with the webpki crate, and work to solve it is ongoing (will hopefully land in a release in a few months or so).
-
Preparing Rustls for Wider Adoption
> Bundling this set with Firefox
I love that they did that; it was actually my idea (https://bugzilla.mozilla.org/show_bug.cgi?id=657228). I believe the list is pretty large and changes frequently and so they download it dynamically.
> short cut to a "Yes"
Do they really do that? That's awesome if so. Then they don't even need to ship the roots.
> I specifically don't like [...] saying "unknown issuer"
https://github.com/briansmith/webpki/issues/221
> If std::fs::File::open() gives me Result with an io:Error that claims "File not found" but the underlying OS file open actually failed due to a permission error, you can see why that's a problem right? Even if this hypothetical OS doesn't expose any specific errors, "File not found" is misleading.
A more accurate analogy: You ask to open "example.txt" without supplying the path, and there is no "example.txt" in the current working directory. You will get "file not found."
Regardless, I agree we could have a better name than UnknownIssuer for this error.
What are some alternatives?
cargo-deny - ❌ Cargo plugin for linting your dependencies 🦀
rust-native-tls
chrono - Date and time library for Rust
rustls - A modern TLS library in Rust
vulndb - [mirror] The Go Vulnerability Database
rust-crypto - A (mostly) pure-Rust implementation of various cryptographic algorithms.
rustsec - RustSec API & Tooling
rust-openssl - OpenSSL bindings for Rust
Rudra - Rust Memory Safety & Undefined Behavior Detection
schannel-rs - Schannel API-bindings for rust (provides an interface for native SSL/TLS using windows APIs)
dwflist - The DWF IDs
sodiumoxide - [DEPRECATED] Sodium Oxide: Fast cryptographic library for Rust (bindings to libsodium)