Problem: cargo audit fails

[devashishdxt]

Vulnerabilities

RUSTSEC-2021-0076

libsecp256k1 allows overflowing signatures

Details
Package	libsecp256k1
Version	0.3.5
URL	paritytech/libsecp256k1#67
Date	2021-07-13
Patched versions	>=0.5.0

libsecp256k1 accepts signatures whose R or S parameter is larger than the
secp256k1 curve order, which differs from other implementations. This could
lead to invalid signatures being verified.

The error is resolved in 0.5.0 by adding a check_overflow flag.

RUSTSEC-2021-0073

Conversion from prost_types::Timestamp to SystemTime can cause an overflow and panic

Details
Package	prost-types
Version	0.7.0~
URL	tokio-rs/prost#438
Date	2021-07-08
Patched versions	>=0.8.0

Affected versions of this crate contained a bug in which untrusted input could cause an overflow and panic when converting a Timestamp to SystemTime.

It is recommended to upgrade to prost-types v0.8 and switch the usage of From<Timestamp> for SystemTime to TryFrom<Timestamp> for SystemTime.

See #438 for more information.

RUSTSEC-2020-0159

Potential segfault in localtime_r invocations

Details
Package	chrono
Version	0.4.19
URL	chronotope/chrono#499
Date	2020-11-10

Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.

No workarounds are known.

[devashishdxt]

Created a PR to upgrade dependencies of tiny-hderive: maciejhirsz/tiny-hderive#7

[tomtau]

what about using https://crates.io/crates/bip32 instead of tiny-hderive?

[devashishdxt]

what about using https://crates.io/crates/bip32 instead of tiny-hderive?

Created a PR for this: #22.

[devashishdxt]

Regression in v0.8.0 of prost: tokio-rs/prost#502 and tokio-rs/prost#507

[devashishdxt]

Potential segfault in chrono crate: chronotope/chrono#499