924a1345b1
## Issue Addressed NA ## Proposed Changes As `cargo audit` astutely pointed out, the version of `zeroize_derive` were were using had a vulnerability: ``` Crate: zeroize_derive Version: 1.1.0 Title: `#[zeroize(drop)]` doesn't implement `Drop` for `enum`s Date: 2021-09-24 ID: RUSTSEC-2021-0115 URL: https://rustsec.org/advisories/RUSTSEC-2021-0115 Solution: Upgrade to >=1.2.0 ``` This PR updates `zeroize` and `zeroize_derive` to appease `cargo audit`. `tiny-bip39` was also updated to allow compile. ## Additional Info I don't believe this vulnerability actually affected the Lighthouse code-base directly. However, `tiny-bip39` may have been affected which may have resulted in some uncleaned memory in Lighthouse. Whilst this is not ideal, it's not a major issue. Zeroization is a nice-to-have since it only protects from sophisticated attacks or attackers that already have a high level of access already.
22 lines
539 B
TOML
22 lines
539 B
TOML
[package]
|
|
name = "eth2_wallet"
|
|
version = "0.1.0"
|
|
authors = ["Paul Hauner <paul@paulhauner.com>"]
|
|
edition = "2018"
|
|
|
|
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
|
|
|
|
[dependencies]
|
|
serde = "1.0.116"
|
|
serde_json = "1.0.58"
|
|
serde_repr = "0.1.6"
|
|
uuid = { version = "0.8.1", features = ["serde", "v4"] }
|
|
rand = "0.7.3"
|
|
eth2_keystore = { path = "../eth2_keystore" }
|
|
eth2_key_derivation = { path = "../eth2_key_derivation" }
|
|
tiny-bip39 = "0.8.1"
|
|
|
|
[dev-dependencies]
|
|
hex = "0.4.2"
|
|
tempfile = "3.1.0"
|