rustyverse/rustytorch

Fork 0

Files

T

redclawsystems 4d88dc0584 Initial commit

2026-03-04 00:08:42 +00:00

4.3 KiB

Raw Blame History

RustyTorch++ Security Audit Report

Date: 2025-12-16 Tool: cargo-audit (RustSec Advisory Database) Total Dependencies: 1413 crates

Summary

Category	Before	After
Vulnerabilities	7	4
Warnings (unmaintained)	14	~14
Total Advisories	21	~18

Fixed Vulnerabilities (2025-12-16)

✅ object_store 0.8 → 0.11 (RUSTSEC-2024-0358)
✅ ring 0.16 → 0.17 (RUSTSEC-2025-0009)
✅ tonic 0.12 → 0.13 (RUSTSEC-2025-0019)

Vulnerabilities (Require Action)

1. RUSTSEC-2024-0421: idna Punycode Validation Issue

Crate: idna 0.4.0
Severity: Low
Fix: Upgrade to >=1.0.0
Path: idna → validator → rtx-config
Action: Update validator crate to newer version

2. RUSTSEC-2024-0358: object_store AWS Token Exposure

Crate: object_store 0.8.0
Severity: Low (3.8)
Fix: Upgrade to >=0.10.2
Path: object_store → rtx-hub
Action: Update object_store in rtx-hub

3. RUSTSEC-2024-0437: protobuf Uncontrolled Recursion

Crate: protobuf 2.28.0
Severity: Medium
Fix: Upgrade to >=3.7.2
Path: protobuf → prometheus → rtx-monitoring/rtx-serving-api/rtx-streaming
Action: Update prometheus crate or switch to prometheus-client
Note: prometheus 0.13.4 uses old protobuf; may need to switch metrics library

4. RUSTSEC-2025-0020: pyo3 Buffer Overflow Risk

Crate: pyo3 0.20.3
Severity: Medium
Fix: Upgrade to >=0.24.1
Path: pyo3 → rtx-sklearn-py
Action: Update pyo3 in rtx-sklearn-py (major version bump)

5. RUSTSEC-2025-0009: ring AES Panic Issue

Crate: ring 0.16.20
Severity: Low
Fix: Upgrade to >=0.17.12
Path: ring → rtx-platform, rtx-federated
Action: Update ring dependency

6. RUSTSEC-2023-0071: rsa Timing Side-channel (Marvin Attack)

Crate: rsa 0.9.8
Severity: Medium (5.9)
Fix: ⚠️ NO FIX AVAILABLE
Path: rsa → sqlx-mysql → sqlx → many crates
Action: Monitor for upstream fix; consider avoiding MySQL RSA auth
Mitigation: Use password authentication instead of RSA key exchange

7. RUSTSEC-2025-0019: tonic Buffer Overflow

Crate: tonic 0.12.3 and 0.13.0
Severity: Medium
Fix: Upgrade to >=0.13.1
Path: tonic → rtx-streaming, rtx-distributed, etc.
Action: Update tonic to 0.13.1+

Warnings (Unmaintained Crates)

These crates are no longer maintained but may not have active vulnerabilities:

Crate	Advisory	Alternative
`proc-macro-error`	RUSTSEC-2024-0370	Use `manyhow` or `proc-macro-error2`
`instant`	RUSTSEC-2024-0384	Use `std::time::Instant` or `web-time`
`serde-xml-rs`	RUSTSEC-2024-0399	Use `quick-xml` with serde
`rusttype`	RUSTSEC-2021-0140	Use `ab_glyph`
`term_size`	RUSTSEC-2020-0163	Use `terminal_size`
`safemem`	RUSTSEC-2023-0081	Use standard library
`raw-cpuid`	RUSTSEC-2021-0089	Update to latest version
`mach`	RUSTSEC-2020-0168	Use `mach2`
`ansi_term`	RUSTSEC-2021-0139	Use `nu-ansi-term` or `yansi`

Remediation Plan

Priority 1: Critical/Immediate

tonic - Update to 0.13.1+ (buffer overflow)
protobuf/prometheus - Evaluate switching to prometheus-client

Priority 2: High

pyo3 - Update to 0.24.1+ (buffer overflow risk)
ring - Update to 0.17.12+ (panic issue)
object_store - Update to 0.10.2+ (token exposure)

Priority 3: Medium

idna/validator - Update validator crate
rsa - Monitor upstream; mitigate via auth config

Priority 4: Low (Warnings)

Replace unmaintained crates when convenient

Commands

# Re-run audit
cargo audit

# Update specific dependency
cargo update -p <package_name>

# Check for available updates
cargo outdated

CI/CD Integration

Security scanning is already integrated in .github/workflows/ci.yml:

- name: Security audit
  uses: rustsec/audit-check@v2
  with:
    token: ${{ secrets.GITHUB_TOKEN }}

Notes

The rsa vulnerability has no fix yet; sqlx team is aware
Many warnings are from transitive dependencies (not direct)
Consider using cargo deny for stricter dependency policies

4.3 KiB Raw Blame History