[GHSA-rv9v-r4vm-gj8x] Miniscript allows stack consumption

[apoelstra]

Updates

• Affected products
• Description
• Severity

Comments
Affected versions are wrong.

[apoelstra]

I don't know why the form keeps changing the "severity" and I don't know how to properly specify the affected versions.

But right now this is a false positive. Can somebody please fix it?

[darakian]

Hey @apoelstra, ya I can fix that on our end. Any chance you have release notes or commits or something to support this change of versions?

[apoelstra]

@darakian the CHANGELOG.md on each of the fixed versions mentions it, but I realize that there isn't anywhere that has all the versions at once. (We are not very good at forward-porting changelog entries. I will file an issue to do this if it's a prerequisite to fixing the advisory here.)

But meanwhile you can see the changelog entries invidiually for

• 12.2.0 https://github.com/rust-bitcoin/rust-miniscript/pull/712/files
• 11.2.0 https://github.com/rust-bitcoin/rust-miniscript/pull/713/files
• 10.2.0 https://github.com/rust-bitcoin/rust-miniscript/pull/714/files
• 9.2.0 https://github.com/rust-bitcoin/rust-miniscript/pull/715/files

Each of those is a short identical fix which updates the CHANGELOG, Cargo.toml version, and the actual code.

[github-actions]

👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details.

[apoelstra]

The "affected versions" on GHSA-rv9v-r4vm-gj8x are still incorrect.

[advisory-database]

Hi @apoelstra! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!

[darakian]

@apoelstra sorry about the delay this got away from me. Should be good now 👍

[apoelstra]

@darakian great, thank you so much!

And I will remember this PR to crib syntax from, so that if this happens again I should be able to fix it myself :).