All right -- filed rustsec/advisory-db#1911. Feel free to comment on the PR if anything's inaccurate or missing, thanks!

Commented about affected versions and platforms. Thanks for putting this up!

Based on https://github.com/RustSec/advisory-db/blob/main/CONTRIBUTING.md#optional-steps:

We should definitely yank all old versions of the crate. (They will still be fetched if folks have a pinned Cargo.lock.)

From https://doc.rust-lang.org/cargo/commands/cargo-yank.html#when-to-yank:

Crates should only be yanked in exceptional circumstances, for example, an accidental publish, an unintentional SemVer breakages, or a significantly broken and unusable crate. In the case of security vulnerabilities, RustSec is typically a less disruptive mechanism to inform users and encourage them to upgrade, and avoids the possibility of significant downstream disruption irrespective of susceptibility to the vulnerability in question.

At least to me, it sounds like the general guidance is to not yank the versions in this scenario.

Uh oh!

Create RUSTSEC advisory for illumos stack buffer overflow for 1.4.x #97

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions