162
sudo-rs Affected By Multiple Security Vulnerabilities - Impacting Ubuntu 25.10 (www.phoronix.com)
submitted 1 year ago by to c/linux@programming.dev
57 comments fedilink hide all child comments
 

The Ubuntu 25.10 transition to using some Rust system utilities continues proving quite rocky. Beyond some early performance issues with Rust Coreutils, breakage for some executables, and broken unattended upgrades due to a Rust Coreutils bug, it's also sudo-rs now causing Ubuntu developers some headaches. There are two moderate security issues affecting sudo-rs, the Rust version of sudo being used by Ubuntu 25.10.

you are viewing a single comment's thread
view the rest of the comments
[–] 4 points 1 year ago (2 children)

Tbh that specific case probably wouldn't be a big deal. It's all the extra processing curl can do for http requests and the like that'd be more dangerous to rewrite I'd think.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 1 year ago (1 child)

    The most relevant part of the curl project is the library, not the CLI tool. And its biggest advantages in addition to universal availability is support for many protocols other than HTTP, flexible interface(s), two useful well-documented and largely stable APIs (one wraps the other for easy use), multiple TLS/SSL back-end support, and finally, the complete(ish) HTTP protocol support. But that last one alone is not that big of a deal. libcurl's implementation even uses external libraries for both HTTP2 and HTTP3 for framing. It uses an external library for QUIC transport support too. Meanwhile, many other independent language implementations for HTTP exist that range from serviceable to complete. Be it Python, Go, Rust, or many others, you usually get a "native" option you could/should use. Gone are the days of bad old PHP. Hell, even some WIP languages add usable native implementations sometimes as a part of their standard libraries, like inko.

    Within the Rust ecosystem, you're fully covered by hyper. Even very obscure HTTP features like obsolete HTTP1 multi-line headers are supported (you have to enable this one explicitly). And I only know this because I had the fortunate circumstance of coming across a server that used these (It was an educational, if interesting, couple of afternoon hours).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 1 year ago

    Yeah, what I was saying was that rather than the basic take URL and just put the file on the filesystem use case (which is in the common case not that difficult with stuff like reqwest or hyper), the other use cases where you for instance use the library to process requests and their responses in non-default or potentially bizarre ways is more likely where there'd be an issue. When I said "extra processing" for requests, I was including for instance potentially dealing with TLS and interactions between underlying libraries and so on with all the various protocols curl supports.

  • permalink
  • fedilink
  • source
  • parent