Parity-ethereum: error: Vulnerable crates found!

[5chdn]

• Parity Ethereum version: 2.1.2
• Operating system: Linux
• Installation: built from source
• Fully synchronized: no
• Network: ethereum
• Restarted: yes

    Scanning Cargo.lock for vulnerabilities (385 crate dependencies)
error: Vulnerable crates found!

ID:  RUSTSEC-2018-0003
Crate:   smallvec
Version: 0.2.1
Date:    2018-07-19
URL:     https://github.com/servo/rust-smallvec/issues/96
Title:   Possible double free during unwinding in SmallVec::insert_many
Solution: upgrade to: >= 0.6.3 OR ^0.3.4 OR ^0.4.5 OR ^0.5.1

ID:  RUSTSEC-2018-0001
Crate:   untrusted
Version: 0.5.1
Date:    2018-06-21
URL:     https://github.com/briansmith/untrusted/pull/20
Title:   An integer underflow could lead to panic
Solution: upgrade to: >= 0.6.2

error: 2 vulnerabilities found!
ERROR: Job failed: exit code 1

[5chdn]

https://gitlab.parity.io/parity/parity-ethereum/-/jobs/103461

[ordian]

@5chdn this should be fixed in #9657 (see paritytech/devops/issues/216)

[5chdn]

This PR is pretty much in limbo. Is it that involved to fix?

[kirushik]

@5chdn Yes, it involves re-writing the util/fetch with a new Hyper. I will try to make #9657 happen, that's our safest bet.

[c0gent]

I can get #9657 mergable today... Maybe...