Dear Rust Developers,

As a heads up, several pre-existing security tickets filed against arrow-rs
have been added[1][2] to the RUSTSEC database[1][2] a few hours ago. The
author says he plans to file additional RUSTSEC entries for the other
security tickets [3].

The criteria used for adding the arrow issues to the RUSTSEC database is
not clear to me,  but given widely used tools such as `cargo audit` report
such issues, it is likely that this will become an visible issue for our
users soon.

Given this, I will likely start looking into existing security issues [4]
reported against arrow-rs and any help would be appreciated.

Andrew

[1] https://github.com/rustsec/advisory-db/pull/1057
[2] https://github.com/rustsec/advisory-db/pull/1059
[3] https://github.com/rustsec/advisory-db/pull/1057#issuecomment-930455127
[4] https://github.com/apache/arrow-rs/labels/security

Reply via email to