Vulnerability with prost (a libp2p dependency)
#2443
Comments
|
@paulhauner rust-libp2p v0.39.1 uses prost v0.8: |
bors bot
pushed a commit
that referenced
this issue
Aug 12, 2021
## Issue Addressed - Resolves #2457 - Resolves #2443 ## Proposed Changes Target the (presently unreleased) head of `libp2p/rust-libp2p:master` in order to obtain the fix from libp2p/rust-libp2p#2175. Additionally: - `libsecp256k1` needed to be upgraded to satisfy the new version of `libp2p`. - There were also a handful of minor changes to `eth2_libp2p` to suit some interface changes. - Two `cargo audit --ignore` flags were remove due to libp2p upgrades. ## Additional Info NA
|
Resolved via #2493 |
pawanjay176
pushed a commit
to pawanjay176/lighthouse
that referenced
this issue
Aug 27, 2021
## Issue Addressed - Resolves sigp#2457 - Resolves sigp#2443 ## Proposed Changes Target the (presently unreleased) head of `libp2p/rust-libp2p:master` in order to obtain the fix from libp2p/rust-libp2p#2175. Additionally: - `libsecp256k1` needed to be upgraded to satisfy the new version of `libp2p`. - There were also a handful of minor changes to `eth2_libp2p` to suit some interface changes. - Two `cargo audit --ignore` flags were remove due to libp2p upgrades. ## Additional Info NA
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description
In #2436 I've ignored the following
cargo auditvuln: https://github.com/libp2p/rust-libp2p/blob/master/core/Cargo.tomlWe need to upgrade to
prost >= 0.8.0to resolve this vuln, however lip2p is still on0.7: https://github.com/libp2p/rust-libp2p/blob/master/core/Cargo.tomlSteps to resolve
The text was updated successfully, but these errors were encountered: