Migrate all advisories to V2 format (closes #228)

As announced in #228, this commit migrates all advisories to the new V2
format, which splits version information into a separate section, and
now has a structure which corresponds to the internal code structure of
the `rustsec` crate.

This is a breaking change for users of `cargo-audit` < 0.9, and anyone
who has written a 3rd party advisory format parser.
This commit is contained in:
Tony Arcieri
2020-03-01 10:42:21 -08:00
parent c54e93a581
commit 64c17acfe3
67 changed files with 325 additions and 223 deletions

View File

@@ -2,7 +2,6 @@
id = "RUSTSEC-2018-0008"
package = "slice-deque"
date = "2018-12-05"
patched_versions = [">= 0.1.16"]
url = "https://github.com/gnzlbg/slice_deque/issues/57"
keywords = ["memory-corruption", "rce"]
title = "Bug in SliceDeque::move_head_unchecked allows read of corrupted memory"
@@ -23,3 +22,6 @@ alter program execution.
The flaw was corrected by properly updating the head and tail of the deque in
this case. """
[versions]
patched = [">= 0.1.16"]

View File

@@ -3,12 +3,10 @@ id = "RUSTSEC-2019-0002"
package = "slice-deque"
date = "2019-05-07"
title = "Bug in SliceDeque::move_head_unchecked corrupts its memory"
patched_versions = [">= 0.2.0"]
url = "https://github.com/gnzlbg/slice_deque/issues/57"
keywords = ["memory-corruption", "rce"]
references = ["RUSTSEC-2018-0008"]
description = """
Affected versions of this crate entered a corrupted state if
`mem::size_of::<T>() % allocation_granularity() != 0` and a specific allocation
pattern was used: sufficiently shifting the deque elements over the mirrored
@@ -22,4 +20,8 @@ whose value representation is not meaningful). This is undefined behavior.
The flaw was corrected by using a pair of pointers to track the head and tail of
the deque instead of a pair of indices. This pair of pointers are represented
using a Rust slice."""
using a Rust slice.
"""
[versions]
patched = [">= 0.2.0"]