3 ms·
Anyone know if this will by default resolve the 11 outstanding CVEs? Ironically there is one CVE reported in the bzip2 crate [1] https://app.opencve.io/cve/?p
by firesteelrain 1y ago
Anyone know if this will by default resolve the 11 outstanding CVEs?
Ironically there is one CVE reported in the bzip2 crate
[1] https://app.opencve.io/cve/?product=bzip2&vendor=bzip2_project https://app.opencve.io/cve/?product=bzip2&vendor=bzip2_proje...
- Philpax 1y ago> The bzip2 crate before 0.4.4 They're releasing 0.6.0 today :>
- tialaramex 1y agoThere's certainly a contrast between the "Oops a huge file causes a runtime failure" reported for that crate and a bunch of "Oops we have bounds misses" in C. I wonder how hard anybody worked on trying to exploit the bounds misses to get code execution. It may or may not be impossible to achieve that escalation.
- HackerThemAll 1y ago[flagged]
- jorams 1y agoBut it does apply to the bzip2 crate, which is the topic of discussion. Its new pure-rust implementation is libbz2-rs-sys, not bzip2-rs. The last sentence is irrelevant.
- debugnik 1y agoThis article is about the bzip2 crate, not the bzip2-rs crate, despite the repo for the former having the name of the latter.
- conorjh 1y ago[dead]