Project

General

Profile

Actions
Copy link

Bug #29218

closed

Vulnerabilities detected in Rust dependencies

Bug #29218: Vulnerabilities detected in Rust dependencies

Added by Alexis Mousset 8 days ago. Updated 3 days ago.

Status:
Released
Priority:
N/A
Assignee:
Martin HART
Category:
Security
Target version:
8.3.13
Pull Request:
https://github.com/Normation/rudder/p...
Severity:
UX impact:
User visibility:
Effort required:
Priority:
0
Name check:
To do
Fix check:
Checked
Regression:
No

Description

warning[source-not-allowed]: detected 'git' source not explicitly allowed
    ┌─ /home/dev/Projects/rudder/Cargo.lock:133:26
    │
133 │ format_serde_error 0.3.1 git+https://github.com/fennewald/format_serde_error/?rev=06ef275
    │                          ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ source
    │
    ├ format_serde_error v0.3.1
      └── rudderc v0.0.0-dev
          └── lib v0.0.0-dev

warning[source-not-allowed]: detected 'git' source not explicitly allowed
    ┌─ /home/dev/Projects/rudder/Cargo.lock:406:22
    │
406 │ test-generator 0.3.0 git+https://github.com/JamesGuthrie/test-generator?rev=82e7999
    │                      ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ source
    │
    ├ test-generator v0.3.0
      ├── (dev) rudder_module_type v0.0.0-dev
      │   ├── rudder-module-augeas v0.0.0-dev
      │   ├── rudder-module-directory v0.0.0-dev
      │   ├── rudder-module-system-updates v0.0.0-dev
      │   ├── rudder-module-template v0.0.0-dev
      │   └── rudder_commons_test v0.0.0-dev
      │       ├── (dev) rudder-module-augeas v0.0.0-dev (*)
      │       ├── (dev) rudder-module-directory v0.0.0-dev (*)
      │       ├── (dev) rudder-module-system-updates v0.0.0-dev (*)
      │       └── (dev) rudder-module-template v0.0.0-dev (*)
      └── (dev) rudderc v0.0.0-dev
          └── lib v0.0.0-dev

warning[license-not-encountered]: license was not encountered
   ┌─ /home/dev/Projects/rudder/deny.toml:18:6
   │
18 │     "CC0-1.0",
   │      ━━━━━━━ unmatched license allowance

warning[license-not-encountered]: license was not encountered
   ┌─ /home/dev/Projects/rudder/deny.toml:11:6
   │
11 │     "GPL-3.0",
   │      ━━━━━━━ unmatched license allowance

warning[license-not-encountered]: license was not encountered
   ┌─ /home/dev/Projects/rudder/deny.toml:19:6
   │
19 │     "LGPL-2.0",    
   │      ━━━━━━━━ unmatched license allowance

warning[license-not-encountered]: license was not encountered
   ┌─ /home/dev/Projects/rudder/deny.toml:13:6
   │
13 │     "Unicode-DFS-2016",
   │      ━━━━━━━━━━━━━━━━ unmatched license allowance

error[vulnerability]: mXSS in ammonia via MathML `annotation-xml` encoding strip
  ┌─ /home/dev/Projects/rudder/Cargo.lock:5:1
  │
5 │ ammonia 4.1.2 registry+https://github.com/rust-lang/crates.io-index
  │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
  │
  ├ ID: RUSTSEC-2026-0193
  ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0193
  ├ If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

    The `annotation-xml` tag has slightly different behavior than the other "integration point" 
    tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly
    strip the namespace-incompatible tags.

    This vulnerability only has an effect when the `math` and `annotation-xml` tags
    are both enabled, but the `encoding` attribute is disabled, because it relies
    on the following sequence of steps:

    1. User writes code like `<math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>`.
    2. Namespace filtering checks the DOM, and it passes. `<gadget>` is parsed as HTML.
    3. Attribute filter strips it down to `<math><annotation-xml><gadget></annotation-xml></math>`. Because the encoding attribute is gone, `<gadget>` is now parsed as MathML.
    4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

    Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML.
    These [elements] are:

    * title
    * textarea
    * xmp
    * iframe
    * noembed
    * noframes
    * plaintext
    * noscript
    * style
    * script

    Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

    [elements]: https://github.com/servo/html5ever/blob/045a0378f2b0f8d4a350793899cf722a2a9b3d11/html5ever/src/tree_builder/rules.rs

    ---

    **Discovered by:** ivan0912 (YesWeHack) · **Date:** 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.
  ├ Solution: Upgrade to >=4.1.3 OR >=4.0.2, <4.1.0 OR >=3.3.2, <4.0.0 (try `cargo update -p ammonia`)
  ├ ammonia v4.1.2
    └── mdbook v0.4.45
        └── rudderc v0.0.0-dev
            └── lib v0.0.0-dev

error[unsound]: Unsoundness in `Error::downcast_mut()`
   ┌─ /home/dev/Projects/rudder/Cargo.lock:14:1
   │
14 │ anyhow 1.0.96 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
   │
   ├ ID: RUSTSEC-2026-0190
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0190
   ├ Affected versions of this crate violate borrow rules, resulting in undefined behavior, when the user adds context to an error via `Error::context` and then later calls `Error::downcast_mut` on the returned `Error`.

     The flaw was corrected in commit `6e8c000` by revising how the mutable reference is constructed, avoiding inclusion of a shared reference in the resulting borrow chain.

     ## Example

     ```rust
     use anyhow::Error;
     use std::fmt;

     #[derive(Debug)]
     struct ErrorContext(&'static str);

     impl fmt::Display for ErrorContext {
         fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
             fmt::Display::fmt(&self.0, f)
         }
     }

     fn main() {
         let mut error = Error::msg("inner error").context(ErrorContext("old context"));
         let context: &mut ErrorContext = error.downcast_mut().unwrap();
         context.0 = "new context";
         println!("{:?}", error);
     }
     ```

     ## Miri output

     ```
     error: Undefined Behavior: trying to retag from <1538> for Unique permission at alloc602[0x38], but that tag only grants SharedReadOnly permission for this location
        --> src/ptr.rs:170:18
         |
     170 |         unsafe { &mut *self.ptr.as_ptr() }
         |                  ^^^^^^^^^^^^^^^^^^^^^^^ this error occurs as part of retag at alloc602[0x38..0x48]
         |
         = help: this indicates a potential bug in the program: it performed an invalid operation, but the Stacked Borrows rules it violated are still experimental
         = help: see https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/stacked-borrows.md for further information
     help: <1538> was created by a SharedReadOnly retag at offsets [0x38..0x48]
        --> src/ptr.rs:89:18
         |
      89 |             ptr: NonNull::from(ptr),
         |                  ^^^^^^^^^^^^^^^^^^
         = note: stack backtrace:
                 0: anyhow::ptr::Mut::<'_, ErrorContext>::deref_mut
                     at src/ptr.rs:170:18: 170:41
                 1: anyhow::error::<impl anyhow::Error>::downcast_mut::<ErrorContext>
                     at src/error.rs:560:18: 560:46
                 2: main
                     at examples/downcast_mut.rs:15:38: 15:58
     ```
   ├ Announcement: https://github.com/dtolnay/anyhow/issues/451
   ├ Solution: Upgrade to >=1.0.103 (try `cargo update -p anyhow`)
   ├ anyhow v1.0.96
     ├── lib v0.0.0-dev
     ├── mdbook v0.4.45
     │   └── rudderc v0.0.0-dev
     │       └── lib v0.0.0-dev (*)
     ├── rudder-module-augeas v0.0.0-dev
     ├── rudder-module-directory v0.0.0-dev
     ├── rudder-module-inventory v0.0.0-dev
     ├── rudder-module-system-updates v0.0.0-dev
     ├── rudder-module-template v0.0.0-dev
     ├── rudder-package v0.0.0-dev
     ├── rudder-relayd v0.0.0-dev
     │   └── rudder-report v0.1.0
     ├── rudder_cli v0.0.0-dev
     │   ├── rudder-package v0.0.0-dev (*)
     │   └── rudderc v0.0.0-dev (*)
     ├── rudder_commons v0.0.0-dev
     │   ├── lib v0.0.0-dev (*)
     │   ├── rudder_module_type v0.0.0-dev
     │   │   ├── rudder-module-augeas v0.0.0-dev (*)
     │   │   ├── rudder-module-directory v0.0.0-dev (*)
     │   │   ├── rudder-module-system-updates v0.0.0-dev (*)
     │   │   ├── rudder-module-template v0.0.0-dev (*)
     │   │   └── rudder_commons_test v0.0.0-dev
     │   │       ├── (dev) rudder-module-augeas v0.0.0-dev (*)
     │   │       ├── (dev) rudder-module-directory v0.0.0-dev (*)
     │   │       ├── (dev) rudder-module-system-updates v0.0.0-dev (*)
     │   │       └── (dev) rudder-module-template v0.0.0-dev (*)
     │   └── (build) rudderc v0.0.0-dev (*)
     ├── rudder_module_type v0.0.0-dev (*)
     └── rudderc v0.0.0-dev (*)

error[vulnerability]: Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
   ┌─ /home/dev/Projects/rudder/Cargo.lock:77:1
   │
77 │ crossbeam-epoch 0.9.18 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0204
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0204
   ├ Affected versions of `fmt::Display` dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with `Atomic::null` or `Shared::null`. `fmt::Debug` impls and pre-0.9 `fmt::Display` impls, which do not dereference pointers, are not affected by this issue.
   ├ Announcement: https://github.com/crossbeam-rs/crossbeam/pull/1276
   ├ Solution: Upgrade to >=0.9.20 (try `cargo update -p crossbeam-epoch`)
   ├ crossbeam-epoch v0.9.18
     └── crossbeam-deque v0.8.6
         └── rayon-core v1.12.1
             └── rayon v1.10.0
                 ├── criterion v0.5.1
                 │   └── (dev) rudder-relayd v0.0.0-dev
                 │       └── rudder-report v0.1.0
                 └── sysinfo v0.33.1
                     └── rudder-module-inventory v0.0.0-dev

warning[yanked]: detected yanked crate (try `cargo update -p zip`)
    ┌─ /home/dev/Projects/rudder/Cargo.lock:527:1
    │
527 │ zip 2.2.3 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ yanked version
    │
    ├ zip v2.2.3
      ├── rudder-relayd v0.0.0-dev
      │   └── rudder-report v0.1.0
      └── rudderc v0.0.0-dev
          └── lib v0.0.0-dev

warning[advisory-not-detected]: advisory was not encountered
   ┌─ /home/dev/Projects/rudder/deny.toml:27:6
   │
27 │     "RUSTSEC-2024-0421",
   │      ━━━━━━━━━━━━━━━━━ no crate matched advisory criteria

warning[advisory-not-detected]: advisory was not encountered
   ┌─ /home/dev/Projects/rudder/deny.toml:29:6
   │
29 │     "RUSTSEC-2025-0056",
   │      ━━━━━━━━━━━━━━━━━ no crate matched advisory criteria

Updated by Alexis Mousset 8 days ago Actions
Copy link
 #1

  • Status changed from New to In progress
  • Assignee set to Alexis Mousset

Updated by Alexis Mousset 8 days ago Actions
Copy link
 #2

  • Status changed from In progress to Pending technical review
  • Assignee changed from Alexis Mousset to Martin HART
  • Pull Request set to https://github.com/Normation/rudder/pull/7272

Updated by Alexis Mousset 8 days ago Actions
Copy link
 #3

  • Status changed from Pending technical review to Pending release

Updated by Alexis Mousset 7 days ago Actions
Copy link
 #4

  • Fix check changed from To do to Checked

Updated by Alexis Mousset 3 days ago Actions
Copy link
 #5

  • Status changed from Pending release to Released

This bug has been fixed in Rudder 8.3.13 which was released today.

Actions
Copy link

Also available in: PDF Atom