Skip to content
This repository has been archived by the owner on Nov 15, 2023. It is now read-only.

RUSTSEC-2021-0076 and libsecp256k1 version in sp-core #9356

Closed
trevor-crypto opened this issue Jul 15, 2021 · 0 comments · Fixed by #9391
Closed

RUSTSEC-2021-0076 and libsecp256k1 version in sp-core #9356

trevor-crypto opened this issue Jul 15, 2021 · 0 comments · Fixed by #9391

Comments

@trevor-crypto
Copy link
Contributor

There has been a new RUSTSEC issue that stems from libsecp256k1: https://rustsec.org/advisories/RUSTSEC-2021-0076

I would like to bump libsecp256k1 in sp-core, but there are two blockers in the way:

  1. There's a bug that is solved on master but not yet in a release, which is needed to make the changes from 0.3.5 -> 0.5.x: Removes redundant util::self libsecp256k1#63
  2. libsecp256k1 no_std is broken. I submitted a PR already and tracking here: no-std support broken in 0.5.0 libsecp256k1#71

Once these are resolved I will submit a PR to bump the dependency and make the required changes.
This was referenced Jul 19, 2021
Closed
Open
trevor-crypto added a commit to trevor-crypto/substrate that referenced this issue Jul 20, 2021
@trevor-crypto
Bumped libsecp256k1 to 0.6.0
15fafb6 
Changes were made to conform to the version differences

Closes paritytech#9356
trevor-crypto added a commit to trevor-crypto/substrate that referenced this issue Jul 20, 2021
@trevor-crypto
RUSTSEC-2021-0076 bump libsecp256k1
ae43d37 
libsecp256k1 allows overflowing signatures
https://rustsec.org/advisories/RUSTSEC-2021-0076

Changes were made to conform to libsecp256k1 version differences.

Closes paritytech#9356
@trevor-crypto trevor-crypto mentioned this issue Jul 20, 2021
Merged
trevor-crypto added a commit to trevor-crypto/substrate that referenced this issue Jul 21, 2021
@trevor-crypto
RUSTSEC-2021-0076 bump libsecp256k1
249851a 
libsecp256k1 allows overflowing signatures
https://rustsec.org/advisories/RUSTSEC-2021-0076

Changes were made to conform to libsecp256k1 version differences.

Closes paritytech#9356
trevor-crypto added a commit to trevor-crypto/substrate that referenced this issue Jul 21, 2021
@trevor-crypto
RUSTSEC-2021-0076 bump libsecp256k1
d7b5619 
libsecp256k1 allows overflowing signatures
https://rustsec.org/advisories/RUSTSEC-2021-0076

Changes were made to conform to libsecp256k1 version differences.

Closes paritytech#9356
@clangenb clangenb mentioned this issue Jul 28, 2021
Closed
trevor-crypto added a commit to trevor-crypto/substrate that referenced this issue Aug 5, 2021
@trevor-crypto
RUSTSEC-2021-0076 bump libsecp256k1
dd35dcb 
libsecp256k1 allows overflowing signatures
https://rustsec.org/advisories/RUSTSEC-2021-0076

Changes were made to conform to libsecp256k1 version differences.

Closes paritytech#9356
trevor-crypto added a commit to trevor-crypto/substrate that referenced this issue Aug 16, 2021
@trevor-crypto
RUSTSEC-2021-0076 bump libsecp256k1
a13869a 
libsecp256k1 allows overflowing signatures
https://rustsec.org/advisories/RUSTSEC-2021-0076

Changes were made to conform to libsecp256k1 version differences.

Closes paritytech#9356
@ghost ghost closed this as completed in #9391 Aug 16, 2021
ghost pushed a commit that referenced this issue Aug 16, 2021
@trevor-crypto @bkchr
RUSTSEC-2021-0076 bump libsecp256k1 (#9391)
08cac00 
* RUSTSEC-2021-0076 bump libsecp256k1

libsecp256k1 allows overflowing signatures
https://rustsec.org/advisories/RUSTSEC-2021-0076

Changes were made to conform to libsecp256k1 version differences.

Closes #9356

* parse_standard_slice() -> parse_overflowing_slice()

* Added v2 host function for ecdsa_verify

* Add feature tag over helpers

* Added ecdsa_verify v2 to test runner

* PR feedback

- Spaces -> tabs
- renamed two helper functions

* Fixed imports after rebasing

* Bump rest of libsecp256k1 (and libp2p)

libp2p also uses libsecp256k1 so it is required to be bumped too, along
with all the version difference changes.

* Add version2 for ecdsa pubkey recovery

* libp2p rebase master fixes

* Fix test panic when non Behaviour event is returned

* Update bin/node/browser-testing/Cargo.toml

* Update primitives/core/src/ecdsa.rs

* Update primitives/core/src/ecdsa.rs

* Update Cargo.lock

Co-authored-by: Bastian Köcher <bkchr@users.noreply.github.com>
Neopallium pushed a commit to PolymeshAssociation/substrate that referenced this issue Sep 2, 2021
@trevor-crypto @bkchr @Neopallium
RUSTSEC-2021-0076 bump libsecp256k1 (paritytech#9391)
696d714 
* RUSTSEC-2021-0076 bump libsecp256k1

libsecp256k1 allows overflowing signatures
https://rustsec.org/advisories/RUSTSEC-2021-0076

Changes were made to conform to libsecp256k1 version differences.

Closes paritytech#9356

* parse_standard_slice() -> parse_overflowing_slice()

* Added v2 host function for ecdsa_verify

* Add feature tag over helpers

* Added ecdsa_verify v2 to test runner

* PR feedback

- Spaces -> tabs
- renamed two helper functions

* Fixed imports after rebasing

* Bump rest of libsecp256k1

* Add version2 for ecdsa pubkey recovery

* Update primitives/core/src/ecdsa.rs

* Update primitives/core/src/ecdsa.rs

* Update Cargo.lock

Co-authored-by: Bastian Köcher <bkchr@users.noreply.github.com>
@Neopallium Neopallium mentioned this issue Sep 2, 2021
Merged
gilescope pushed a commit that referenced this issue Sep 6, 2021
@trevor-crypto @bkchr @gilescope
RUSTSEC-2021-0076 bump libsecp256k1 (#9391)
6148380 
* RUSTSEC-2021-0076 bump libsecp256k1

libsecp256k1 allows overflowing signatures
https://rustsec.org/advisories/RUSTSEC-2021-0076

Changes were made to conform to libsecp256k1 version differences.

Closes #9356

* parse_standard_slice() -> parse_overflowing_slice()

* Added v2 host function for ecdsa_verify

* Add feature tag over helpers

* Added ecdsa_verify v2 to test runner

* PR feedback

- Spaces -> tabs
- renamed two helper functions

* Fixed imports after rebasing

* Bump rest of libsecp256k1 (and libp2p)

libp2p also uses libsecp256k1 so it is required to be bumped too, along
with all the version difference changes.

* Add version2 for ecdsa pubkey recovery

* libp2p rebase master fixes

* Fix test panic when non Behaviour event is returned

* Update bin/node/browser-testing/Cargo.toml

* Update primitives/core/src/ecdsa.rs

* Update primitives/core/src/ecdsa.rs

* Update Cargo.lock

Co-authored-by: Bastian Köcher <bkchr@users.noreply.github.com>
adamdossa pushed a commit to PolymeshAssociation/substrate that referenced this issue Sep 6, 2021
@trevor-crypto @bkchr @adamdossa
RUSTSEC-2021-0076 bump libsecp256k1 (paritytech#9391)
1fe1f43 
* RUSTSEC-2021-0076 bump libsecp256k1

libsecp256k1 allows overflowing signatures
https://rustsec.org/advisories/RUSTSEC-2021-0076

Changes were made to conform to libsecp256k1 version differences.

Closes paritytech#9356

* parse_standard_slice() -> parse_overflowing_slice()

* Added v2 host function for ecdsa_verify

* Add feature tag over helpers

* Added ecdsa_verify v2 to test runner

* PR feedback

- Spaces -> tabs
- renamed two helper functions

* Fixed imports after rebasing

* Bump rest of libsecp256k1

* Add version2 for ecdsa pubkey recovery

* Update primitives/core/src/ecdsa.rs

* Update primitives/core/src/ecdsa.rs

* Update Cargo.lock

Co-authored-by: Bastian Köcher <bkchr@users.noreply.github.com>
bkchr added a commit that referenced this issue Sep 7, 2021
@chevdor @trevor-crypto
@bkchr @adoerr
Cherry Pick of PR #9676 + #9391 (#9704)
56a3f5d 
* RUSTSEC-2021-0076 bump libsecp256k1 (#9391)

* RUSTSEC-2021-0076 bump libsecp256k1

libsecp256k1 allows overflowing signatures
https://rustsec.org/advisories/RUSTSEC-2021-0076

Changes were made to conform to libsecp256k1 version differences.

Closes #9356

* parse_standard_slice() -> parse_overflowing_slice()

* Added v2 host function for ecdsa_verify

* Add feature tag over helpers

* Added ecdsa_verify v2 to test runner

* PR feedback

- Spaces -> tabs
- renamed two helper functions

* Fixed imports after rebasing

* Bump rest of libsecp256k1 (and libp2p)

libp2p also uses libsecp256k1 so it is required to be bumped too, along
with all the version difference changes.

* Add version2 for ecdsa pubkey recovery

* libp2p rebase master fixes

* Fix test panic when non Behaviour event is returned

* Update bin/node/browser-testing/Cargo.toml

* Update primitives/core/src/ecdsa.rs

* Update primitives/core/src/ecdsa.rs

* Update Cargo.lock

Co-authored-by: Bastian Köcher <bkchr@users.noreply.github.com>

* Use coherent prost crate  versions (#9676)

* Bump node-browser-testing deps on prost

Co-authored-by: Trevor Arjeski <72849114+trevor-crypto@users.noreply.github.com>
Co-authored-by: Bastian Köcher <bkchr@users.noreply.github.com>
Co-authored-by: Andreas Doerr <adoerr@users.noreply.github.com>
cmichi pushed a commit that referenced this issue Sep 9, 2021
@chevdor @trevor-crypto
@bkchr @adoerr @cmichi
Cherry Pick of PR #9676 + #9391 (#9704)
b409c70 
* RUSTSEC-2021-0076 bump libsecp256k1 (#9391)

* RUSTSEC-2021-0076 bump libsecp256k1

libsecp256k1 allows overflowing signatures
https://rustsec.org/advisories/RUSTSEC-2021-0076

Changes were made to conform to libsecp256k1 version differences.

Closes #9356

* parse_standard_slice() -> parse_overflowing_slice()

* Added v2 host function for ecdsa_verify

* Add feature tag over helpers

* Added ecdsa_verify v2 to test runner

* PR feedback

- Spaces -> tabs
- renamed two helper functions

* Fixed imports after rebasing

* Bump rest of libsecp256k1 (and libp2p)

libp2p also uses libsecp256k1 so it is required to be bumped too, along
with all the version difference changes.

* Add version2 for ecdsa pubkey recovery

* libp2p rebase master fixes

* Fix test panic when non Behaviour event is returned

* Update bin/node/browser-testing/Cargo.toml

* Update primitives/core/src/ecdsa.rs

* Update primitives/core/src/ecdsa.rs

* Update Cargo.lock

Co-authored-by: Bastian Köcher <bkchr@users.noreply.github.com>

* Use coherent prost crate  versions (#9676)

* Bump node-browser-testing deps on prost

Co-authored-by: Trevor Arjeski <72849114+trevor-crypto@users.noreply.github.com>
Co-authored-by: Bastian Köcher <bkchr@users.noreply.github.com>
Co-authored-by: Andreas Doerr <adoerr@users.noreply.github.com>
apopiak pushed a commit that referenced this issue Sep 13, 2021
@trevor-crypto @bkchr @apopiak
RUSTSEC-2021-0076 bump libsecp256k1 (#9391)
6ac80d3 
* RUSTSEC-2021-0076 bump libsecp256k1

libsecp256k1 allows overflowing signatures
https://rustsec.org/advisories/RUSTSEC-2021-0076

Changes were made to conform to libsecp256k1 version differences.

Closes #9356

* parse_standard_slice() -> parse_overflowing_slice()

* Added v2 host function for ecdsa_verify

* Add feature tag over helpers

* Added ecdsa_verify v2 to test runner

* PR feedback

- Spaces -> tabs
- renamed two helper functions

* Fixed imports after rebasing

* Bump rest of libsecp256k1 (and libp2p)

libp2p also uses libsecp256k1 so it is required to be bumped too, along
with all the version difference changes.

* Add version2 for ecdsa pubkey recovery

* libp2p rebase master fixes

* Fix test panic when non Behaviour event is returned

* Update bin/node/browser-testing/Cargo.toml

* Update primitives/core/src/ecdsa.rs

* Update primitives/core/src/ecdsa.rs

* Update Cargo.lock

Co-authored-by: Bastian Köcher <bkchr@users.noreply.github.com>
This issue was closed.
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

RUSTSEC-2021-0076 bump libsecp256k1 trevor-crypto/substrate
1 participant
@trevor-crypto