You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Dependabot just issued RUSTSEC-2022-0093 for a project of mine. The issue is resolved in ed25519-dalek starting from 2.0.0 of the crate.
This crate is a transitive dependency of my crate, hence I'm filing this here.
Can you please update your usage of the ed25519-dalek crate?
The text was updated successfully, but these errors were encountered:
I've bumped the library in #173 - would appreciate if you can look through it.
Do I understand it correctly that the vulnerability is only exploitable if there's an API that allows signing with an incoherent public/secret keypair? In that case, russh isn't directly affected since the keypair is encapsulated in russh_keys::Keypair after loading from a file/buffer
Dependabot just issued RUSTSEC-2022-0093 for a project of mine. The issue is resolved in ed25519-dalek starting from
2.0.0
of the crate.This crate is a transitive dependency of my crate, hence I'm filing this here.
Can you please update your usage of the
ed25519-dalek
crate?The text was updated successfully, but these errors were encountered: