Repository: ALU-Schumacher/AUDITOR (language: rust)

Issue:
RUSTSEC-2024-0402: Borsh serialization of HashMap is non-canonical

> Borsh serialization of HashMap is non-canonical

| Details             |                                                |
| ------------------- | ---------------------------------------------- |
| Package             | `hashbrown`                      |
| Version             | `0.15.0`                   |
| URL                 | [https://github.com/rust-lang/hashbrown/issues/576](https://github.com/rust-lang/hashbrown/issues/576) |
| Date                | 2024-10-11                         |
| Patched versions    | `>=0.15.1`                  |
| Unaffected versions | `<0.15.0`               |

The borsh serialization of the HashMap did not follow the borsh specification.
It potentially produced non-canonical encodings dependent on insertion order.
It also did not perform canonicty checks on decoding.

This can result in consensus splits and cause equivalent objects to be
considered distinct.

This was patched in 0.15.1.

See [advisory page](https://rustsec.org/advisories/RUSTSEC-2024-0402.html) for additional details.



Discussion / hints:

Fix patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c9b2dc5dd..6e470cc48 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Security
 - [RUSTSEC-2024-0363]: Update sqlx from 0.7.4 to 0.8.2 (missed some occurrences) ([@dirksammel](https://github.com/dirksammel))
 - [RUSTSEC-2024-0399]: Update rustls from 0.23.16 to 0.23.19 ([@dirksammel](https://github.com/dirksammel))
+- [RUSTSEC-2024-0402]: Update hashbrown from 0.15.0 to 0.15.2 ([@dirksammel](https://github.com/dirksammel))
 
 ### Added
 - CI: Add workflow to test publishing to the PyPI test repo ([@dirksammel](https://github.com/dirksammel))
diff --git a/Cargo.lock b/Cargo.lock
index 0c19dc56f..52c4899e6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1,6 +1,6 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 3
+version = 4
 
 [[package]]
 name = "actix-codec"
@@ -1386,9 +1386,9 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.15.0"
+version = "0.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e087f84d4f86bf4b218b927129862374b72199ae7d8657835f1e89000eea4fb"
+checksum = "bf151400ff0baff5465007dd2f3e717f3fe502074ca563069ce3a6629d07b289"
 
 [[package]]
 name = "hashlink"
@@ -1640,7 +1640,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "707907fe3c25f5424cce2cb7e1cbcafee6bdbe735ca90ef77c29e84591e5b9da"
 dependencies = [
  "equivalent",
- "hashbrown 0.15.0",
+ "hashbrown 0.15.2",
  "serde",
 ]
 


Test patch: