osv-scanner results

[jayvdb]

This is a repeat of #51 . It wasnt solved.

> osv-scanner --lockfile Cargo.lock 
Scanned /home/jayvdb/rust/apalis/Cargo.lock file and found 489 packages
╭─────────────────────────────────────┬──────┬───────────┬─────────────────┬─────────┬────────────╮
│ OSV URL                             │ CVSS │ ECOSYSTEM │ PACKAGE         │ VERSION │ SOURCE     │
├─────────────────────────────────────┼──────┼───────────┼─────────────────┼─────────┼────────────┤
│ https://osv.dev/GHSA-qc84-gqf4-9926 │ 8.1  │ crates.io │ crossbeam-utils │ 0.7.2   │ Cargo.lock │
│ https://osv.dev/RUSTSEC-2022-0041   │      │           │                 │         │            │
│ https://osv.dev/GHSA-5wg8-7c9q-794v │ 5.5  │ crates.io │ lock_api        │ 0.3.4   │ Cargo.lock │
│ https://osv.dev/GHSA-gmv4-vmx3-x9f3 │      │           │                 │         │            │
│ https://osv.dev/GHSA-hj9h-wrgg-hgmx │      │           │                 │         │            │
│ https://osv.dev/GHSA-ppj3-7jw3-8vc4 │      │           │                 │         │            │
│ https://osv.dev/GHSA-vh4p-6j7g-f4j9 │      │           │                 │         │            │
│ https://osv.dev/RUSTSEC-2020-0070   │      │           │                 │         │            │
│ https://osv.dev/RUSTSEC-2020-0168   │      │ crates.io │ mach            │ 0.3.2   │ Cargo.lock │
│ https://osv.dev/GHSA-wfg4-322g-9vqv │      │ crates.io │ memoffset       │ 0.5.6   │ Cargo.lock │
│ https://osv.dev/RUSTSEC-2023-0045   │      │           │                 │         │            │
│ https://osv.dev/RUSTSEC-2020-0016   │      │ crates.io │ net2            │ 0.2.39  │ Cargo.lock │
│ https://osv.dev/GHSA-fg7r-2g4j-5cgr │ 8.1  │ crates.io │ tokio           │ 0.1.22  │ Cargo.lock │
│ https://osv.dev/RUSTSEC-2021-0124   │      │           │                 │         │            │
╰─────────────────────────────────────┴──────┴───────────┴─────────────────┴─────────┴────────────╯

[jayvdb]

It looks like a lot of them come from the "trace" feature, due to "tracing-futures" crate.

https://github.com/tokio-rs/tracing/issues?q=is%3Aissue+is%3Aopen+rustsec picks up a few of them.

In their repo, it looks like:

tracing> osv-scanner --lockfile Cargo.lock 
Scanned /home/jayvdb/rust/tracing/Cargo.lock file and found 280 packages
╭─────────────────────────────────────┬──────┬───────────┬─────────────────┬─────────┬────────────╮
│ OSV URL                             │ CVSS │ ECOSYSTEM │ PACKAGE         │ VERSION │ SOURCE     │
├─────────────────────────────────────┼──────┼───────────┼─────────────────┼─────────┼────────────┤
│ https://osv.dev/GHSA-g98v-hv3f-hcfr │      │ crates.io │ atty            │ 0.2.14  │ Cargo.lock │
│ https://osv.dev/RUSTSEC-2021-0145   │      │           │                 │         │            │
│ https://osv.dev/GHSA-qc84-gqf4-9926 │ 8.1  │ crates.io │ crossbeam-utils │ 0.7.2   │ Cargo.lock │
│ https://osv.dev/RUSTSEC-2022-0041   │      │           │                 │         │            │
│ https://osv.dev/GHSA-5wg8-7c9q-794v │ 5.5  │ crates.io │ lock_api        │ 0.3.4   │ Cargo.lock │
│ https://osv.dev/GHSA-gmv4-vmx3-x9f3 │      │           │                 │         │            │
│ https://osv.dev/GHSA-hj9h-wrgg-hgmx │      │           │                 │         │            │
│ https://osv.dev/GHSA-ppj3-7jw3-8vc4 │      │           │                 │         │            │
│ https://osv.dev/GHSA-vh4p-6j7g-f4j9 │      │           │                 │         │            │
│ https://osv.dev/RUSTSEC-2020-0070   │      │           │                 │         │            │
│ https://osv.dev/GHSA-wfg4-322g-9vqv │      │ crates.io │ memoffset       │ 0.5.6   │ Cargo.lock │
│ https://osv.dev/RUSTSEC-2023-0045   │      │           │                 │         │            │
│ https://osv.dev/RUSTSEC-2020-0016   │      │ crates.io │ net2            │ 0.2.39  │ Cargo.lock │
│ https://osv.dev/RUSTSEC-2021-0127   │      │ crates.io │ serde_cbor      │ 0.11.2  │ Cargo.lock │
│ https://osv.dev/GHSA-fg7r-2g4j-5cgr │ 8.1  │ crates.io │ tokio           │ 0.1.22  │ Cargo.lock │
│ https://osv.dev/RUSTSEC-2021-0124   │      │           │                 │         │            │
╰─────────────────────────────────────┴──────┴───────────┴─────────────────┴─────────┴────────────╯

[jayvdb]

#205 fixes "mach", and maybe others

[jayvdb]

Rechecked main, and indeed we're done!

> osv-scanner --lockfile Cargo.lock 
Scanned /home/jayvdb/rust/apalis/Cargo.lock file and found 432 packages
No vulnerabilities found