Edouard Vanbelle
77 lines
4.1 KiB
TOML
77 lines
4.1 KiB
TOML
[advisories]
|
|
ignore = [
|
|
# paste unmaintained — transitive via azure_core 0.21.0 (latest available).
|
|
# No direct security impact; no upgrade path exists.
|
|
# keep warning "RUSTSEC-2024-0436",
|
|
|
|
# rand 0.7.3 unsound — transitive via http-types → azure_core 0.21.0.
|
|
# Only exploitable with a custom logger using rand::rng(); not applicable here.
|
|
"RUSTSEC-2026-0097",
|
|
|
|
# RUSTSEC-2023-0071 (Marvin Attack): rsa crate is a transitive dependency from jsonwebtoken.
|
|
# Not affected: This application uses HS256 for internal JWT signing and only performs
|
|
# RSA public key verification (not private key operations) for OIDC/OAuth2 tokens.
|
|
"RUSTSEC-2023-0071",
|
|
|
|
# rustls-webpki 0.101.7 — three advisories, all transitive via AWS SDK → rustls 0.21.12.
|
|
# aws-sdk-s3 1.x (latest) has not yet migrated to rustls 0.23.x; no upgrade path available.
|
|
# Severity: low — exploitation requires either a rogue CA or a MitM on AWS S3 infrastructure.
|
|
# RUSTSEC-2026-0104: DoS via panic in CRL parsing (only if CRLs are processed).
|
|
# RUSTSEC-2026-0098: URI name constraints ignored (requires CA misissuance).
|
|
# RUSTSEC-2026-0099: Wildcard name constraint bypass (requires CA misissuance).
|
|
"RUSTSEC-2026-0104",
|
|
"RUSTSEC-2026-0098",
|
|
"RUSTSEC-2026-0099",
|
|
|
|
# instant unmaintained — transitive via azure_core 0.21.0 (latest available).
|
|
# No direct security impact; no upgrade path exists.
|
|
"RUSTSEC-2024-0384",
|
|
|
|
# quick-xml 0.31.0 — transitive via azure_core 0.21.0 (unofficial SDK,
|
|
# now archived). Our direct dep is already on 0.41.0; the 0.31 copy is
|
|
# only reachable through the azure_storage_blobs chain, which parses
|
|
# XML responses received from Azure Storage over TLS. Neither CVE is
|
|
# exploitable without attacker-controlled XML, so the vector requires
|
|
# MitM of the TLS channel to Azure (or a compromised storage
|
|
# endpoint). Real fix is migrating to the official azure_core 1.0 /
|
|
# azure_storage_blob 1.0 SDK — tracked separately.
|
|
# RUSTSEC-2026-0195: unbounded ns-declaration allocation → mem-DoS
|
|
# RUSTSEC-2026-0194: quadratic dup-attribute check → CPU-DoS
|
|
"RUSTSEC-2026-0195",
|
|
"RUSTSEC-2026-0194",
|
|
|
|
# wasmtime 43.0.2 — "Stores can mix up type indices between engines"
|
|
# (GHSA-hgjw-h833-99q9). Transitive via extism 1.30.0 (latest published;
|
|
# extism `main` still pins wasmtime 43, no upgrade path). The advisory
|
|
# has no patched 43.x — fix requires wasmtime >=46.0.2 or >=47.0.3, and
|
|
# forcing that via [patch.crates-io] would break extism (three major
|
|
# wasmtime API bumps between 43 and 46). Real fix waits on extism
|
|
# upstream to migrate.
|
|
#
|
|
# Runtime exposure is zero in default deployments:
|
|
# - `plugins` is an OPT-IN build feature; default builds and the CI
|
|
# release binary don't link wasmtime at all.
|
|
# - Runtime activation additionally requires OXICLOUD_ENABLE_PLUGINS=true.
|
|
# - Plugin binaries are ADMIN-SUPPLIED, not attacker input.
|
|
# - The advisory's attack pattern is multi-Engine Store-sharing;
|
|
# OxiCloud's plugin runtime creates one fresh Plugin per invocation
|
|
# with its own Store (see infrastructure/services/plugins/runtime.rs).
|
|
"RUSTSEC-2026-0222",
|
|
|
|
# astral-tokio-tar 0.5.6 — tar extraction advisories, transitive via
|
|
# testcontainers → testcontainers-modules, a DEV-dependency used only by
|
|
# the `--cfg integration_tests` harness to spin up throwaway Postgres
|
|
# containers. Never compiled into the production binary and never fed
|
|
# attacker-controlled tar input — the only archives extracted are the
|
|
# official Postgres images the test harness pulls. testcontainers 0.25.2
|
|
# pins astral-tokio-tar to ^0.5, so the fixed 0.6.x is not reachable
|
|
# without a testcontainers major bump (tracked separately).
|
|
# RUSTSEC-2026-0145 / -0112: PAX header desynchronization
|
|
# RUSTSEC-2026-0113: unpack_in symlink-following chmod
|
|
# RUSTSEC-2026-0066: insufficient PAX extension validation (low)
|
|
"RUSTSEC-2026-0145",
|
|
"RUSTSEC-2026-0112",
|
|
"RUSTSEC-2026-0113",
|
|
"RUSTSEC-2026-0066",
|
|
]
|