Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

In-tree libraries vulnerable to RUSTSEC-2023-0052 due to jsonrpsee #2

Closed
2 tasks done
kayabaNerve opened this issue Aug 23, 2023 · 8 comments · Fixed by paritytech/substrate#14820
Closed
2 tasks done

In-tree libraries vulnerable to RUSTSEC-2023-0052 due to jsonrpsee #2

kayabaNerve opened this issue Aug 23, 2023 · 8 comments · Fixed by paritytech/substrate#14820

Comments

@kayabaNerve
Copy link

Is there an existing issue?

  • I have searched the existing issues

Experiencing problems? Have you tried our Stack Exchange first?

  • This is not a support question.

Description of bug

jsonrpsee (currently 0.16) pulls in a variety of legacy networking crates, including ones vulnerable to RUSTSEC-2023-0052. AFAICT, updating to 0.20 updates everything (or almost everything) in the dependency tree from webpki to rustls-webpki, resolving the RUSTSEC (and also modernizing the tree in generally).

I did try to perform the work locally, yet the amount of changes to the subscription API made me realize I could not do a proper job within a reasonable amount of time due to my unfamiliarity with the codebase in question.

Apologies if this isn't optimally filed.

Steps to reproduce

No response
@ggwpez
Copy link
Member

ggwpez commented Aug 23, 2023

cc @niklasad1
There is a MR open here paritytech/substrate#14771, but no integration work so far.

@ggwpez
Copy link
Member

ggwpez commented Aug 23, 2023

The bump bot actually claims that this closes the problem for us paritytech/substrate#14812

certificate path building and verification is now capped at 100 signature validation operations to avoid the risk of CPU usage denial-of-service attack when validating crafted certificate chains producing quadratic runtime. This risk affected both clients, as well as servers that verified client certificates.

@niklasad1
Copy link
Member

niklasad1 commented Aug 23, 2023 •
edited
Loading

There is an open PR for jsonrpsee bump paritytech/substrate#13992 but we have discovered a few regressions, it's on our radar.

FWIW, it just the jsonrpsee client that is concerned by this issue and I think bumping the rustls-webpki should do it.

@kayabaNerve
Copy link
Author

Sorry for missing the PRs, and thanks for clarifying it's the client code alone.

0.16 uses webpki, which doesn't have a bump available, not rustls-webpki hence the issue (though again, I do hear that's just for the client code which I'm unsure if it impacts this repo directly).

@niklasad1
Copy link
Member

It doesn't impact the substrate node (the RPC server) but there are some "tools" in the substrate repo that are using jsonrpsee client.

@niklasad1
Copy link
Member

I'll fix this issue on jsonrpsee v0.16 as well

niklasad1 referenced this issue in paritytech/substrate Aug 23, 2023
@niklasad1
chore: bump jsonrpsee v0.16.3
3878694 
Close https://github.com/paritytech/substrate/issues/14814
@niklasad1 niklasad1 mentioned this issue Aug 23, 2023
Merged
@kayabaNerve
Copy link
Author

Much appreciated! Thank you for the patch release!

@the-right-joyce the-right-joyce transferred this issue from paritytech/substrate Aug 24, 2023
@niklasad1
Copy link
Member

Closed by the jsonrpsee patch release v0.16.3

@github-project-automation github-project-automation bot moved this from backlog to done in SDK Node Aug 24, 2023
@kayabaNerve kayabaNerve mentioned this issue Oct 31, 2023
Open
github-merge-queue bot pushed a commit that referenced this issue Feb 6, 2024
@AndreiEres @sandreim
subsystem-bench: Prepare CI output (#3158)
9e6298e 
1. Benchmark results are collected in a single struct.
2. The output of the results is prettified.
3. The result struct used to save the output as a yaml and store it in
artifacts in a CI job.

```
$ cargo run -p polkadot-subsystem-bench --release -- test-sequence --path polkadot/node/subsystem-bench/examples/availability_read.yaml | tee output.txt
$ cat output.txt

polkadot/node/subsystem-bench/examples/availability_read.yaml #1

Network usage, KiB                     total   per block
Received from peers               510796.000  170265.333
Sent to peers                        221.000      73.667

CPU usage, s                           total   per block
availability-recovery                 38.671      12.890
Test environment                       0.255       0.085


polkadot/node/subsystem-bench/examples/availability_read.yaml #2

Network usage, KiB                     total   per block
Received from peers               413633.000  137877.667
Sent to peers                        353.000     117.667

CPU usage, s                           total   per block
availability-recovery                 52.630      17.543
Test environment                       0.271       0.090


polkadot/node/subsystem-bench/examples/availability_read.yaml #3

Network usage, KiB                     total   per block
Received from peers               424379.000  141459.667
Sent to peers                        703.000     234.333

CPU usage, s                           total   per block
availability-recovery                 51.128      17.043
Test environment                       0.502       0.167

```

```
$ cargo run -p polkadot-subsystem-bench --release -- --ci test-sequence --path polkadot/node/subsystem-bench/examples/availability_read.yaml | tee output.txt
$ cat output.txt
- benchmark_name: 'polkadot/node/subsystem-bench/examples/availability_read.yaml #1'
  network:
  - resource: Received from peers
    total: 509011.0
    per_block: 169670.33333333334
  - resource: Sent to peers
    total: 220.0
    per_block: 73.33333333333333
  cpu:
  - resource: availability-recovery
    total: 31.845848445
    per_block: 10.615282815
  - resource: Test environment
    total: 0.23582828799999941
    per_block: 0.07860942933333313

- benchmark_name: 'polkadot/node/subsystem-bench/examples/availability_read.yaml #2'
  network:
  - resource: Received from peers
    total: 411738.0
    per_block: 137246.0
  - resource: Sent to peers
    total: 351.0
    per_block: 117.0
  cpu:
  - resource: availability-recovery
    total: 18.93596025099999
    per_block: 6.31198675033333
  - resource: Test environment
    total: 0.2541994199999979
    per_block: 0.0847331399999993

- benchmark_name: 'polkadot/node/subsystem-bench/examples/availability_read.yaml #3'
  network:
  - resource: Received from peers
    total: 424548.0
    per_block: 141516.0
  - resource: Sent to peers
    total: 703.0
    per_block: 234.33333333333334
  cpu:
  - resource: availability-recovery
    total: 16.54178526900001
    per_block: 5.513928423000003
  - resource: Test environment
    total: 0.43960946299999537
    per_block: 0.14653648766666513
```

---------

Co-authored-by: Andrei Sandu <[email protected]>
serban300 added a commit to serban300/polkadot-sdk that referenced this issue Feb 12, 2024
@serban300
Try fix merge queues paritytech#2
624dbfa
fixxxedpoint pushed a commit to fixxxedpoint/polkadot-sdk that referenced this issue Jun 19, 2024
@Marcin-Radecki @lesniak43
A0-4022: Reduced multi block contract migration weight by 4 (parityte…
a213e2a 
…ch#2)

* A0-4022: Reduced multi block contract migration weight by 4

* Previous approach was a no-op
ozgb pushed a commit to ozgb/polkadot-sdk that referenced this issue Jul 8, 2024
@AmbientTea
change: ETCM-7136 add partner-chains-session pallet (paritytech#2)
e75b2a1
@girazoki girazoki mentioned this issue Jul 22, 2024
Merged
liuchengxu added a commit to subcoin-project/polkadot-sdk that referenced this issue Sep 20, 2024
@liuchengxu
Deploy rustdoc on GA (paritytech#2)
efb4c6e 
* Deploy rustdoc on GA

* Update README.md
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
SDK Node
Status: done
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

chore: bump jsonrpsee v0.16.3 paritytech/substrate
3 participants
@ggwpez @niklasad1 @kayabaNerve