NOTICE: Converting advisories to V2 format on March 1st, 2020

[tarcieri]

The Refactor advisory types: add [affected] and [versions] sections PRto the rustsec crate from August 2019 performed some refactoring of the internal data structures used to store advisories, splitting out separate [affected] and [versions] sections:

Advisory V1 Format

https://github.com/RustSec/rustsec-crate/blob/af751d912/tests/support/example_advisory_v1.toml

# Example of a V1 RustSec advisory
# This uses the legacy `patched_versions` field, which we need to support until
# all users have upgraded to parsers which understand the V2 format

[advisory]
id = "RUSTSEC-2001-2101"
package = "base"
title = "All your base are belong to us"
description = "You have no chance to survive. Make your time."
date = "2001-02-03"
url = "https://www.youtube.com/watch?v=jQE66WA2s-A"
keywords = ["how", "are", "you", "gentlemen"]
aliases = ["CVE-2001-2101"]
cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
patched_versions = [">= 1.2.3"]

[affected]
arch = ["x86"]
os = ["windows"]
functions = { "base::belongs::All" = ["< 1.2.3"] }

Advisory V2 Format

https://github.com/RustSec/rustsec-crate/blob/af751d912/tests/support/example_advisory_v2.toml

# Example of a V2 RustSec advisory
# This uses the new `[versions]` subsection, which we'd eventually like to
# switch to, but we need to make sure all users have a `cargo-audit` which
# supports the new format first.

[advisory]
id = "RUSTSEC-2001-2101"
package = "base"
title = "All your base are belong to us"
description = "You have no chance to survive. Make your time."
date = "2001-02-03"
url = "https://www.youtube.com/watch?v=jQE66WA2s-A"
keywords = ["how", "are", "you", "gentlemen"]
aliases = ["CVE-2001-2101"]
cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"

[versions]
patched = [">= 1.2.3"]

[affected]
arch = ["x86"]
os = ["windows"]
functions = { "base::belongs::All" = ["< 1.2.3"] }

Support

The V2 advisory format shipped in September 23rd, 2019 and is supported by:

• rustsec crate >= v0.13 (current release: 0.17)
• cargo-audit >= 0.9 (current release: 0.11)

Transition Plan

The plan is to convert all advisories to the new V2 format on March 1st, 2020.

After transitioning to the V2 format, all versions of these crates (and third party tools directly parsing advisories) will cease to work due to parse errors for the latest_versions field.

Unfortunately, there was no way in these releases to signal that we are retiring earlier releases of cargo-audit and the rustsec crate (new versions check the RustSec Advisory DB for vulnerabilities filed against themselves and will allow us to display warning messages for obsolete versions), so this will be a breaking change that will force people to upgrade.

After making the change, support for the V1 format will be removed from future versions of the rustsec crate and Cargo audit.

Hopefully this is the only breaking change we'll make to the advisory format in the foreseeable future.

[tarcieri]

All advisories were updated to the V2 format in #236.

We hope this doesn't have too much collateral damage, and also want to do an additional "V3" format change prior to a 1.0 release of the rustsec crate and cargo-audit, so if this did impact you, that would be good to know so we can coordinate that change.