starred/hickory-dns

Fork 0

mirror of https://github.com/hickory-dns/hickory-dns.git synced 2026-04-25 11:15:54 +03:00

[GH-ISSUE #522] Security vulnerability in 'untrusted' crate which trust-dns uses #217

New issue

Closed

opened 2026-03-07 22:50:53 +03:00 by kerem · 6 comments

kerem commented

2026-03-07 22:50:53 +03:00

Owner

Originally created by @cswindle on GitHub (Jul 4, 2018).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/522

When running cargo audit against a crate which uses trust-dns it reports there is a security vulnerability in the version of 'untrusted' create which trust-dns uses:

ID: RUSTSEC-2018-0001
Crate: untrusted
Version: 0.3.2
Date: 2018-06-21
URL: https://github.com/briansmith/untrusted/pull/20
Title: An integer underflow could lead to panic
Solution: upgrade to: >= 0.6.2

Could you upgrade to 0.6.2 of 'untrusted' so that cargo audit does not flag a failure?

Originally created by @cswindle on GitHub (Jul 4, 2018). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/522 When running cargo audit against a crate which uses trust-dns it reports there is a security vulnerability in the version of 'untrusted' create which trust-dns uses: ``` ID: RUSTSEC-2018-0001 Crate: untrusted Version: 0.3.2 Date: 2018-06-21 URL: https://github.com/briansmith/untrusted/pull/20 Title: An integer underflow could lead to panic Solution: upgrade to: >= 0.6.2 ``` Could you upgrade to 0.6.2 of 'untrusted' so that cargo audit does not flag a failure?

kerem

2026-03-07 22:50:53 +03:00

closed this issue
added the
bug

trust

crate:client

crate:resolver

crate:rustls
labels

kerem commented

2026-03-07 22:51:09 +03:00

Author

Owner

@bluejekyll commented on GitHub (Jul 4, 2018):

Thank you for the report. I’ll try and do this ASAP.

@bluejekyll commented on GitHub (Jul 4, 2018): Thank you for the report. I’ll try and do this ASAP.

kerem commented

2026-03-07 22:51:14 +03:00

Author

Owner

@bluejekyll commented on GitHub (Jul 4, 2018):

@cswindle can you give me the features you're enabling for trust-dns? I'm guessing it's either dnssec-ring or dns-over-rustls...

As of now, the underlying *ring* library is still in alpha: https://crates.io/crates/ring, 0.13 has the upgraded 0.6.1, but I've been hesitant to upgrade until 0.13 stabalizes.

@briansmith, any guidance here?

@bluejekyll commented on GitHub (Jul 4, 2018): @cswindle can you give me the features you're enabling for trust-dns? I'm guessing it's either `dnssec-ring` or `dns-over-rustls`... As of now, the underlying \*ring\* library is still in alpha: https://crates.io/crates/ring, 0.13 has the upgraded 0.6.1, but I've been hesitant to upgrade until 0.13 stabalizes. @briansmith, any guidance here?

kerem commented

2026-03-07 22:51:19 +03:00

Author

Owner

@briansmith commented on GitHub (Jul 5, 2018):

I would use 0.13-alpha over 0.12 any day, myself. It means everybody using Trust-DNS and using ring for anything would need to upgrade to 0.13-alpha too.

@briansmith commented on GitHub (Jul 5, 2018): I would use 0.13-alpha over 0.12 any day, myself. It means everybody using Trust-DNS and using *ring* for anything would need to upgrade to 0.13-alpha too.

kerem commented

2026-03-07 22:51:24 +03:00

Author

Owner

@bluejekyll commented on GitHub (Jul 6, 2018):

Ok, I'll work on getting this in: #327

@cswindle do you need this in 0.9 or in master?

@bluejekyll commented on GitHub (Jul 6, 2018): Ok, I'll work on getting this in: #327 @cswindle do you need this in 0.9 or in master?

kerem commented

2026-03-07 22:51:29 +03:00

Author

Owner

@bluejekyll commented on GitHub (Jul 8, 2018):

I’m going to close this as it’s resolved in master. If we need this before the next release, it can be backported to 0.9

@bluejekyll commented on GitHub (Jul 8, 2018): I’m going to close this as it’s resolved in master. If we need this before the next release, it can be backported to 0.9

kerem commented

2026-03-07 22:51:34 +03:00

Author

Owner

@cswindle commented on GitHub (Jul 9, 2018):

I am happy for it to just be in master.

@cswindle commented on GitHub (Jul 9, 2018): I am happy for it to just be in master.

kerem referenced this issue

2026-03-16 01:59:26 +03:00

[PR #217] [MERGED] Factor out tokio-openssl support to new trust_dns_openssl crate. #1307