Create RUSTSEC advisory for illumos stack buffer overflow for 1.4.x

[AldaronLau]

Context here: #91

[sunshowers]

Thanks for filing this issue! Would you like to take the lead on it? Otherwise I'm happy to write up an initial draft.

[AldaronLau]

I'm not quite sure where to begin the process, or what best practices there are around filing one, so I'd appreciate help on it.

[sunshowers]

All right, let me start it off then.

[sunshowers]

All right -- filed rustsec/advisory-db#1911. Feel free to comment on the PR if anything's inaccurate or missing, thanks!

[sunshowers]

Based on https://github.com/RustSec/advisory-db/blob/main/CONTRIBUTING.md#optional-steps:

• We should definitely yank all old versions of the crate. (They will still be fetched if folks have a pinned Cargo.lock.)
• It would also be good to file a GHSA advisory, and maybe get a CVE assigned. Only repository maintainers can do this -- and feel free to copy-paste info from the advisory DB PR. The CWE for this is, I believe, CWE-121.

[sunshowers]

All right, https://rustsec.org/advisories/RUSTSEC-2024-0020.html is live.

Never mind re GHSA, I think that will automatically import the advisory: https://docs.github.com/en/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/about-the-github-advisory-database. So I think the only thing left to do is to yank old versions.

[AldaronLau]

All right -- filed rustsec/advisory-db#1911. Feel free to comment on the PR if anything's inaccurate or missing, thanks!

Commented about affected versions and platforms. Thanks for putting this up!

Based on https://github.com/RustSec/advisory-db/blob/main/CONTRIBUTING.md#optional-steps:

• We should definitely yank all old versions of the crate. (They will still be fetched if folks have a pinned Cargo.lock.)

From https://doc.rust-lang.org/cargo/commands/cargo-yank.html#when-to-yank:

Crates should only be yanked in exceptional circumstances, for example, an accidental publish, an unintentional SemVer breakages, or a significantly broken and unusable crate. In the case of security vulnerabilities, RustSec is typically a less disruptive mechanism to inform users and encourage them to upgrade, and avoids the possibility of significant downstream disruption irrespective of susceptibility to the vulnerability in question.

At least to me, it sounds like the general guidance is to not yank the versions in this scenario.

[sunshowers]

Strange re yanking: filed rustsec/advisory-db#1914 about that. Thanks for catching this!