Vulnerability in the `rsa` (a recursive dependency of SeaORM)
Open
Nobody has claimed this yet.
Category:security
- Dominant language
- Rust
- Stars
- 9.9k
- Forks
- 734
- Avg merge
- 6h 36m
- Merged PRs (30d)
- 8
Description
Description
Dependabot complains on a vulnerability in rsa, a recursive dependency of SeaORM. This is a link to the issue: https://rustsec.org/advisories/RUSTSEC-2023-0071.html
Vulnerability location:
├── sea-orm v0.12.15
│ ├── sea-query-binder v0.5.0
│ │ ├── sqlx v0.7.4
│ │ │ ├── sqlx-mysql v0.7.4
│ │ │ │ ├── rsa v0.9.6 <-- Vulnerable
Steps to Reproduce
Run GitHub dependabot on the codebase.
Expected Behavior
No vulnerabilities
Actual Behavior
https://rustsec.org/advisories/RUSTSEC-2023-0071.html
Reproduces How Often
Always
Workarounds
🤷♂️
Reproducible Example
Versions
v0.12.15
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the RustSec RUSTSEC-2023-0071 advisory and the dependency chain shown from SeaORM through sqlx-mysql to rsa. Check how the project’s dependency configuration can remove the reported vulnerability, then run GitHub Dependabot or an equivalent vulnerability check; done means the rsa vulnerability is no longer reported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- databases, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100