Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SECURITY] bump to sqlx 0.7.0 #1753

Closed
Elizafox opened this issue Jul 12, 2023 · 4 comments · Fixed by #1742
Closed

[SECURITY] bump to sqlx 0.7.0 #1753

Elizafox opened this issue Jul 12, 2023 · 4 comments · Fixed by #1742
Assignees

Comments

@Elizafox
Copy link

Description

libsqlite3-sys has a high severity security advisory. sqlx depends on libsqlite3-sys for sqlite support.

The fix has landed in sqlx 0.7.0: launchbadge/sqlx#2387

The sqlx dependency must be updated to fix the issue.

Workarounds

Avoiding huge (billions of character) inputs should prevent triggering the security issue. Sanitising potentially large inputs before passing them to SeaORM should prevent the problem.

Versions

HEAD, and all released supported versions.

@billy1624 billy1624 linked a pull request Jul 12, 2023 that will close this issue
1 task
@billy1624 billy1624 self-assigned this Jul 12, 2023
@billy1624
Copy link
Member

Hey @Elizafox, thanks for the report!! We're aware of the issue and will be be upgraded to SQLx v0.7

@billy1624 billy1624 mentioned this issue Jul 12, 2023
1 task
@Elizafox
Copy link
Author

Awesome. I didn't see a report, so I reported it.

@k-bx
Copy link

k-bx commented Jul 22, 2023

Awesome. Can we expect a crate release today? 🙏

@tyt2y3
Copy link
Member

tyt2y3 commented Jul 23, 2023

Please do not push for a release. At the same time we are doing our best. You can use 0.12.0-rc.5 for now, I believe it is 99% there.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants