1. Forum
  2. Usenet
  3. LINUX.DEBIAN.BUGS.RC

  • Bug#1103252: rust-pprof - soundness issue RUSTSEC-2024-0408

    From Peter Green@21:1/5 to All on Tue Apr 15 18:00:01 2025
    Package: rust-pprof
    Version: 0.13.0-5
    Severity: serious
    X-debbugs-cc: [email protected]

    A soundness issue was reported in rust-prost 0.13, https://rustsec.org/advisories/RUSTSEC-2024-0408.html
    which is reported as causing real-world failures in
    downstream applications.

    I looked at updating to the new upstream version,
    (wip packaging for new upstream version is in the
    debcargo-conf git) but that introduces a dependency
    on a crate that is not in Debian.

    rust-pprof does not appear to have any reverse
    dependencies, and I don't think it should be included
    in trixie in it's current state.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From =?UTF-8?Q?Moritz_M=C3=BChlenhoff?=@21:1/5 to All on Mon Apr 21 14:00:01 2025
    Am Tue, Apr 15, 2025 at 07:52:49PM +0200 schrieb Alexander Kj�ll:
    pprof was at some point needed for the gix stack, if they have moved
    away from using it then I agree that it's not needed in trixie.

    Will this bug be enought to block it, or do we need to do anything more?

    If it's entirely unused, then rather file an RM bug against ftp.debian.org?

    Cheers,
    Moritz

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Peter Michael Green@21:1/5 to All on Mon Apr 21 14:30:01 2025
    On 21/04/2025 12:47, Moritz Mühlenhoff wrote:
    Am Tue, Apr 15, 2025 at 07:52:49PM +0200 schrieb Alexander Kjäll:
    pprof was at some point needed for the gix stack, if they have moved
    away from using it then I agree that it's not needed in trixie.

    Will this bug be enought to block it, or do we need to do anything more?
    If it's entirely unused, then rather file an RM bug against ftp.debian.org?
    Jonas asked for a new upstream version not so long ago, so presumablly
    he has, or had future plans for stuff that depends on pprof. Adding him
    to cc.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)