From 7ef70438bfced4b6ac5eeed63d071c27cee24e6a Mon Sep 17 00:00:00 2001 From: Matt Toohey Date: Mon, 9 Nov 2026 21:18:54 +1100 Subject: [PATCH] chore(deny): ignore RUSTSEC-2026-0459 for libsqlite3-sys while mesh-llm pins rusqlite 0.40 Fixes the `cargo-deny --locked check` failure in the "Rust and tool integration" job. The advisory for `libsqlite3-sys` via C SQLite CVE-2026-119375 (RUSTSEC-2026-0459) was published to the RustSec database at 2026-11-09T09:58Z. Main's last run (58116b826) passed at 09:40Z, before it existed, so every later push on main fails `advisories FAILED`, as PR 2581 does in run 42597238033. The advisory: SQLite before 3.54.0 can return uninitialized page-cache memory when a database file is opened together with a sibling `-wal` file whose page size differs. It is a local information disclosure that needs the victim to open a crafted database and `-wal` pair that a less trusted party wrote. The fix is libsqlite3-sys 0.39 (SQLite 3.54), shipped with rusqlite 0.41. Why an ignore rather than the upgrade: - Cargo.lock has libsqlite3-sys 0.38.2 via rusqlite 0.40.2. Buzz declares `rusqlite = "0.40"`, and mesh-llm-log-store (mesh-llm-sdk rev 5d19ca6, via buzz-mesh-compute) declares `rusqlite = "0.40"` as well, so it cannot take 0.41. libsqlite3-sys has `links = "sqlite3"`, so 0.38 and 0.39 cannot both be in the lockfile. Renovate's bump to 0.41 (PR 873, head becc3aa9c) fails to resolve for exactly this reason: "failed to select a version for `libsqlite3-sys`... conflicts with a previous package which links to `sqlite3`". - mesh-llm's current main (622a92b, 2026-11-09) still pins rusqlite 0.40 and locks libsqlite3-sys 0.38.2, so bumping the mesh-llm rev would not help either. The toolchain (1.98.1) satisfies rusqlite 0.41's MSRV, so the pin is the only blocker. Exposure in Buzz, from the callers of rusqlite in this repository and in the pinned mesh-llm checkout: - `archive/store.rs` opens `/archive/events.sqlite3`, a WAL database Buzz creates and writes itself. - `legacy_communities.rs` opens old Buzz's WebKit `localstorage.sqlite3` read-only, from the old app's own data directory, to import saved communities once. - mesh-llm-log-store opens `log_store.db` under a private root it prepares itself (canonicalised, symlinks rejected). None of these is a user-supplied or imported file, and all live under the user's own account, where a writer already has the user's files. Buzz has no feature that opens a database chosen by the user or received from another party. The deny.toml entry follows the existing ones: a comment with the exposure and the removal condition, plus a `reason`. Remove it when mesh-llm moves to rusqlite 0.41 and Buzz follows. Validation: - `./bin/cargo-deny --locked check advisories` before the change: `error[vulnerability]: libsqlite3-sys via C SQLite CVE-2026-119375`, `advisories FAILED`. - `./bin/cargo-deny --locked check` after the change: `advisories ok, bans ok, licenses ok, sources ok`. The remaining warnings (git sources, duplicates, yanked async-executor/clipboard-win/nostr-sdk, and the undetected RUSTSEC-2026-0381) are unchanged from main. - `git diff --check` passed. - Not run: the rest of the Rust job (fmt, clippy, tests). This change touches no Rust source or lockfile. Signed-off-by: Matt Toohey Co-Authored-By: Claude Fable 5.1 --- deny.toml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/deny.toml b/deny.toml index 78d2bd795b..36657b66d9 100644 --- a/deny.toml +++ b/deny.toml @@ -38,6 +38,18 @@ ignore = [ # proc macro: tauri → gtk 0.18 → glib-macros/gtk3-macros. # Remove when tauri's Linux stack leaves gtk-rs 0.18. { id = "RUSTSEC-2024-0370", reason = "proc-macro-error via tauri → gtk 0.18 → glib-macros/gtk3-macros; unmaintained, not vulnerable" }, + # libsqlite3-sys 0.38.2 bundles SQLite 3.53 (CVE-2026-119375): opening a + # database beside a crafted `-wal` file of another page size can return + # uninitialized memory. Fixed in libsqlite3-sys 0.39 / rusqlite 0.41, but + # mesh-llm-log-store (mesh-llm-sdk rev 5d19ca6) pins rusqlite 0.40, and only + # one libsqlite3-sys may link sqlite3, so Buzz cannot move alone (#873). + # Exposure needs a database and `-wal` pair written by a less trusted party. + # Buzz opens only files under the user's own app data: the archive + # `events.sqlite3` it writes itself, old Buzz's `localstorage.sqlite3` + # read-only, and mesh-llm's `log_store.db` under a private root the log + # store prepares. It never opens a user-supplied or imported database. + # Remove when mesh-llm moves to rusqlite 0.41 and Buzz follows. + { id = "RUSTSEC-2026-0459", reason = "libsqlite3-sys 0.38.2 held by mesh-llm-log-store's rusqlite 0.40 pin (links = sqlite3); Buzz and mesh-llm open only their own app-data databases, never a user-supplied or imported file; remove when mesh-llm moves to rusqlite 0.41" }, ] [licenses]