Repository: rust-lang/mdBook (language: rust)

Issue:
Tungstenite allows remote attackers to cause a denial of service (RUSTSEC-2023-0065)
### Problem

As of current master (49fce6673aa0386750ddd20e1c136c6288644834):
```
mdBook$ cargo audit
...
Crate:     tungstenite
Version:   0.18.0
Title:     Tungstenite allows remote attackers to cause a denial of service
Date:      2023-09-25
ID:        RUSTSEC-2023-0065
URL:       https://rustsec.org/advisories/RUSTSEC-2023-0065
Severity:  7.5 (high)
Solution:  Upgrade to >=0.20.1
Dependency tree:
tungstenite 0.18.0
└── tokio-tungstenite 0.18.0
    └── warp 0.3.5
        └── mdbook 0.4.35

error: 1 vulnerability found!
```

### Steps

1. `git clone https://github.com/rust-lang/mdBook`
2. `cd mdBook`
3. `cargo install cargo-audit --locked`
4. `cargo audit`

### Possible Solution(s)

Upgrade to >=0.20.1

### Notes

_No response_

### Version

```text
mdbook v0.4.35
```


Discussion / hints:
@DuckDuckWhale thanks for the issue. this is blocked on warp updating their dependency of tokio-tungstenite while we follow up and bump the version of warp accordingly. 

Fix patch:
diff --git a/Cargo.lock b/Cargo.lock
index 7412d37e62..f0d8fb293b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -334,6 +334,12 @@ dependencies = [
  "typenum",
 ]
 
+[[package]]
+name = "data-encoding"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e962a19be5cfc3f3bf6dd8f61eb50107f356ad6270fbb3ed41476571db78be5"
+
 [[package]]
 name = "diff"
 version = "0.1.13"
@@ -1802,9 +1808,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-tungstenite"
-version = "0.18.0"
+version = "0.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54319c93411147bced34cb5609a80e0a8e44c5999c93903a81cd866630ec0bfd"
+checksum = "212d5dcb2a1ce06d81107c3d0ffa3121fe974b73f068c8282cb1c32328113b6c"
 dependencies = [
  "futures-util",
  "log",
@@ -1876,13 +1882,13 @@ checksum = "3528ecfd12c466c6f163363caf2d02a71161dd5e1cc6ae7b34207ea2d42d81ed"
 
 [[package]]
 name = "tungstenite"
-version = "0.18.0"
+version = "0.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30ee6ab729cd4cf0fd55218530c4522ed30b7b6081752839b68fcec8d0960788"
+checksum = "9e3dac10fd62eaf6617d3a904ae222845979aec67c615d1c842b4002c7666fb9"
 dependencies = [
- "base64 0.13.1",
  "byteorder",
  "bytes",
+ "data-encoding",
  "http",
  "httparse",
  "log",
@@ -1994,9 +2000,9 @@ dependencies = [
 
 [[package]]
 name = "warp"
-version = "0.3.5"
+version = "0.3.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba431ef570df1287f7f8b07e376491ad54f84d26ac473489427231e1718e1f69"
+checksum = "c1e92e22e03ff1230c03a1a8ee37d2f89cd489e2e541b7550d6afad96faed169"
 dependencies = [
  "bytes",
  "futures-channel",
diff --git a/Cargo.toml b/Cargo.toml
index 7d75e53fdc..c0790300c3 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -44,7 +44,7 @@ ignore = { version = "0.4.20", optional = true }
 # Serve feature
 futures-util = { version = "0.3.28", optional = true }
 tokio = { version = "1.28.1", features = ["macros", "rt-multi-thread"], optional = true }
-warp = { version = "0.3.5", default-features = false, features = ["websocket"], optional = true }
+warp = { version = "0.3.6", default-features = false, features = ["websocket"], optional = true }
 
 # Search feature
 elasticlunr-rs = { version = "3.0.2", optional = true }


Test patch: