chore(deps): update rust crate serde_with to v3.21.0 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
serde_with	dependencies	minor	3.18.0 → 3.21.0
serde_with	dependencies	minor	3.12.0 → 3.21.0

---

serde_with: KeyValueMap serialization panics on empty sequence or map entries

GHSA-7gcf-g7xr-8hxj

More information

Details

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

• Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
• Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

• serde_with/src/key_value_map.rs:590
• serde_with/src/key_value_map.rs:599
• serde_with/src/key_value_map.rs:613
• serde_with/src/key_value_map.rs:632
• serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]

#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]

#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/jonasbb/serde_with/security/advisories/GHSA-7gcf-g7xr-8hxj
• https://github.com/jonasbb/serde_with/pull/966
• https://github.com/jonasbb/serde_with/commit/c8a1d820ea25df01692b367058d587343e199389
• https://github.com/jonasbb/serde_with/releases/tag/v3.21.0
• https://github.com/advisories/GHSA-7gcf-g7xr-8hxj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

serde_with: KeyValueMap serialization panics on empty sequence or map entries

GHSA-7gcf-g7xr-8hxj

More information

Details

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

• Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
• Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

• serde_with/src/key_value_map.rs:590
• serde_with/src/key_value_map.rs:599
• serde_with/src/key_value_map.rs:613
• serde_with/src/key_value_map.rs:632
• serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]

#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]

#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/jonasbb/serde_with/security/advisories/GHSA-7gcf-g7xr-8hxj
• https://github.com/jonasbb/serde_with/pull/966
• https://github.com/jonasbb/serde_with/commit/c8a1d820ea25df01692b367058d587343e199389
• https://github.com/jonasbb/serde_with
• https://github.com/jonasbb/serde_with/releases/tag/v3.21.0

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

jonasbb/serde_with (serde_with)

v3.21.0: serde_with v3.21.0

Compare Source

Security

• GHSA-7gcf-g7xr-8hxj: KeyValueMap serialization panics on empty sequence or map entries
  Bad or attacker controlled values could cause a panic while allocating too large values.
  Fixed in #​966 by setting a maximum allocation size during the creation of collections like Vec or sets.

  Thanks to @​7thParkk for reporting the issue.

Added

• Add NoneAsZero adapter that maps Option<NonZero*> to a plain integer, encoding None as 0 by @​SAY-5 (#​486)

Changed

• Re-enable link-to-definition on docs.rs (#​964)

Fixed

• Fix some doc links to point to the correct types (#​963)
• Re-enable unused_qualifications and fix the resulting findings by @​lms0806 (#​962)

v3.20.0: serde_with v3.20.0

Compare Source

Added

• Add support for base58 encoding, similar to the existing base64 setup by @​mitinarseny (#​943)

Fixed

• Extend base64 with schemars support by @​mitinarseny (#​9949)

v3.19.0: serde_with v3.19.0

Compare Source

Added

• Add support for hashbrown v0.17 (#​940)

  This extends the existing support for hashbrown to the newly released version.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: executor/Cargo.lock

Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path executor/Cargo.toml --package serde_with@3.12.0 --precise 3.21.0
    Updating crates.io index
error: failed to get `wasmparser` as a dependency of package `genvm v0.3.0 (/tmp/renovate/repos/github/genlayerlabs/genvm/executor)`

Caused by:
  failed to load source for dependency `wasmparser`

Caused by:
  unable to update /tmp/renovate/repos/github/genlayerlabs/genvm/executor/third-party/wasm-tools/crates/wasmparser

Caused by:
  failed to read `/tmp/renovate/repos/github/genlayerlabs/genvm/executor/third-party/wasm-tools/crates/wasmparser/Cargo.toml`

Caused by:
  No such file or directory (os error 2)

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

👋 This PR targeted main, so I've retargeted it to the latest dev branch v0.3-dev.

main is protected and is only an alias of the latest release branch (v0.3-dev), kept in lockstep automatically. Active v0.3 work lands on v0.3-dev, which reaches v0.3.x through the standing release-gate PR once the cross-repo E2E matrix is green.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.