Repository navigation
build(deps): bump rsa from 0.9.8 to 0.9.10 in /crates/lance_ffi - #360
Conversation
Bumps [rsa](https://github.com/RustCrypto/RSA) from 0.9.8 to 0.9.10. - [Changelog](https://github.com/RustCrypto/RSA/blob/v0.9.10/CHANGELOG.md) - [Commits](RustCrypto/RSA@v0.9.8...v0.9.10) --- updated-dependencies: - dependency-name: rsa dependency-version: 0.9.10 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
wangyong9999
left a comment
wangyong9999
left a comment
There was a problem hiding this comment.
+1 from dependency/code review.
Reviewed rsa 0.9.8 -> 0.9.10 and num-bigint-dig 0.8.4 -> 0.8.6. The RSA patch rejects a prime value of 1 during private-key validation instead of allowing a panic; the companion bigint update removes an unused dependency and fixes compiler compatibility warnings. No blocking regression found in these diffs.
Important remaining issue: this upgrade DOES NOT fix the Marvin timing side channel (RUSTSEC-2023-0071). RustSec explicitly lists rsa 0.9.10 as still affected, with no patched version. Do not treat this PR as closing that alert. The lockfile brings rsa through reqsign 0.16.5; the inspected reqsign call sites load private keys and sign cloud requests, which does not by itself establish exploitability of the reported decryption attack. Reachability/mitigation of the existing advisory remains separate follow-up work.
References: RustCrypto/RSA#624 and https://rustsec.org/advisories/RUSTSEC-2023-0071.html
Validation boundary: at review time, 5/31 reported checks have succeeded and 26 are still pending/running; I have not run a separate local build. This is a code-review approval, not a claim that CI has passed. Please merge only after all required checks for this head succeed.
2 participants
Bumps rsa from 0.9.8 to 0.9.10.
Changelog
Sourced from rsa's changelog.
Commits
da2af9achore: release v0.9.102926c91fix: do not panic on a prime being 1 when loading a secret key (#624)488d2adchore: release 0.9.9c1f00a3Support for cryptographic operations with larger keys (#594)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.