924a1345b1
## Issue Addressed NA ## Proposed Changes As `cargo audit` astutely pointed out, the version of `zeroize_derive` were were using had a vulnerability: ``` Crate: zeroize_derive Version: 1.1.0 Title: `#[zeroize(drop)]` doesn't implement `Drop` for `enum`s Date: 2021-09-24 ID: RUSTSEC-2021-0115 URL: https://rustsec.org/advisories/RUSTSEC-2021-0115 Solution: Upgrade to >=1.2.0 ``` This PR updates `zeroize` and `zeroize_derive` to appease `cargo audit`. `tiny-bip39` was also updated to allow compile. ## Additional Info I don't believe this vulnerability actually affected the Lighthouse code-base directly. However, `tiny-bip39` may have been affected which may have resulted in some uncleaned memory in Lighthouse. Whilst this is not ideal, it's not a major issue. Zeroization is a nice-to-have since it only protects from sophisticated attacks or attackers that already have a high level of access already.
38 lines
1.2 KiB
TOML
38 lines
1.2 KiB
TOML
[package]
|
|
name = "eth2"
|
|
version = "0.1.0"
|
|
authors = ["Paul Hauner <paul@paulhauner.com>"]
|
|
edition = "2018"
|
|
|
|
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
|
|
|
|
[dependencies]
|
|
serde = { version = "1.0.116", features = ["derive"] }
|
|
serde_json = "1.0.58"
|
|
types = { path = "../../consensus/types" }
|
|
hex = "0.4.2"
|
|
reqwest = { version = "0.11.0", features = ["json","stream"] }
|
|
eth2_libp2p = { path = "../../beacon_node/eth2_libp2p" }
|
|
proto_array = { path = "../../consensus/proto_array", optional = true }
|
|
eth2_serde_utils = "0.1.0"
|
|
zeroize = { version = "1.4.2", features = ["zeroize_derive"] }
|
|
eth2_keystore = { path = "../../crypto/eth2_keystore" }
|
|
libsecp256k1 = "0.6.0"
|
|
ring = "0.16.19"
|
|
bytes = "1.0.1"
|
|
account_utils = { path = "../../common/account_utils" }
|
|
sensitive_url = { path = "../../common/sensitive_url" }
|
|
eth2_ssz = "0.4.0"
|
|
eth2_ssz_derive = "0.3.0"
|
|
futures-util = "0.3.8"
|
|
futures = "0.3.8"
|
|
store = { path = "../../beacon_node/store", optional = true }
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
psutil = { version = "3.2.0", optional = true }
|
|
procinfo = { version = "0.4.2", optional = true }
|
|
|
|
[features]
|
|
default = ["lighthouse"]
|
|
lighthouse = ["proto_array", "psutil", "procinfo", "store"]
|