chore(deps): update env_logger requirement from 0.9.0 to 0.10.0 #302
GitHub Actions / Security audit
failed
Dec 12, 2023 in 0s
Security advisories found
1 advisory(ies)
Details
Vulnerabilities
RUSTSEC-2023-0052
webpki: CPU denial of service in certificate path building
| Details | |
|---|---|
| Package | webpki |
| Version | 0.21.4 |
| Date | 2023-08-22 |
| Patched versions | >=0.22.2 |
When this crate is given a pathological certificate chain to validate, it will
spend CPU time exponential with the number of candidate certificates at each
step of path building.
Both TLS clients and TLS servers that accept client certificate are affected.
This was previously reported in
<briansmith/webpki#69> and re-reported recently
by Luke Malinowski.
webpki 0.22.1 included a partial fix and webpki 0.22.2 added further fixes.
Loading