CVE #630

% cat Cargo.toml
[package]
name = "pizzarat"
description = "the scrappy package generator"
version = "0.0.1"
edition = "2024"
authors = ["Andrew Pennebaker <n4jm4@pm.me>"]
license = "0BSD"
repository = "https://github.com/mcandre/pizzarat"

[dependencies]
apple-bom = "0.3.0"
apple-flat-package = "0.20.0"
cpio-archive = "0.10.0"
deb-rust = "0.1.2"
die = "0.2.0"
flate2 = "1.1.8"
getopts = "0.2.24"
libarchive2 = "0.2.1"
msix = "0.4.0"
serde = { version = "1.0.228", features = ["derive"] }
serde-xml-rs = "0.8.2"
tempfile = "3.24.0"
toml = "0.9.8"
xcommon = "0.3.0"

[lib]
name = "pizzarat"

[[bin]]
name = "pizzarat"
path = "src/pizzarat.rs"

% cargo install audit

% cargo audit
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 902 security advisories (from /Users/andrew/.asdf/installs/rust/1.92.0/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (312 crate dependencies)
Crate:     rsa
Version:   0.7.2
Title:     Marvin Attack: potential key recovery through timing sidechannels
Date:      2023-11-22
ID:        RUSTSEC-2023-0071
URL:       https://rustsec.org/advisories/RUSTSEC-2023-0071
Severity:  5.9 (medium)
Solution:  No fixed upgrade is available!
Dependency tree:
rsa 0.7.2
└── xcommon 0.3.0
    ├── pizzarat 0.0.1
    └── msix 0.4.0
        └── pizzarat 0.0.1

Crate:     rsa
Version:   0.9.10
Title:     Marvin Attack: potential key recovery through timing sidechannels
Date:      2023-11-22
ID:        RUSTSEC-2023-0071
URL:       https://rustsec.org/advisories/RUSTSEC-2023-0071
Severity:  5.9 (medium)
Solution:  No fixed upgrade is available!
Dependency tree:
rsa 0.9.10
└── zar 0.1.4
    └── pizzarat 0.0.1

error: 2 vulnerabilities found!