Add CVE-2019-15541 in rustls example code

[ctz]

This is a bit of a weird one because it's in example code. No amount of upgrading or downgrading will help for vulnerable downstream crates that copied and built upon the problematic example code. For that reason I've listed pre-patch versions as unaffected_versions -- but I'd appreciate your opinion on this.

[tarcieri]

That's a tricky one, for sure! I'll run it by the Secure Code WG and see what they think.

[tarcieri]

Well I'd agree that everyone should upgrade. In general I think this might be a bit noisy a reason for people to do so.

I think it'd be fine to file an advisory for this, but I'd suggest using a VersionReq which won't impact existing users, and publicizing the advisory in other ways.

Otherwise, I think this issue is another good candidate for severity scoring.

[tarcieri]

@ctz I've been hacking on the rustsec crate a bunch and I'm wondering if it might be worth incorporating a concept of an informational advisory that doesn't impact any particular crate versions and won't show up in cargo-audit, but allows you to leverage RustSec as a way to catalog and distribute it. What do you think about that?

[ctz]

That sounds ideal to me.

[tarcieri]

@ctz cool, I happen to be actively working on the rustsec crate right now so I will try to build that in as a first-class concept. Perhaps we could even figure out a way to make it warn but not error. It seems like an "informational advisory" might also be a good way to warn about things like unmaintained crates:

https://internals.rust-lang.org/t/tracking-unmaintained-crates-using-rustsec/10884

In the meantime we can do a hack like:

patched_versions = [">= 0"]

...to ensure it doesn't actually break anyone's build.

[Shnatsel]

There are even more reasons not to surface this in cargo-audit, or for that matter anything that parses RustSec DB:

1. This info should be surfaced to maintainers of directly dependent crates only. If they're found vulnerable, they should get their own RustSec advisories for specific versions. This advisory if landed as-is would also create a non-actionable message to transitively dependent crates, which is a glaring false positive.
2. There is no way to make this message go away. You're stuck with it essentially forever.

Instead I would open bugs on bug trackers of prominent uses of rustls, and file a CVE to alert companies with their proprietary code.

[ctz]

Going to close this, since it was likely an overreaction.