View source on GitHub →

Security Audit Report - cargo-audit

Date: 2025-12-16
Tool: cargo-audit v0.22.0
Status: 3 advisories found (2 errors, 7 warnings)

Summary

  • Critical: 0
  • High: 0
  • Medium: 0
  • Low/Info: 3 (unmaintained crates)
  • Total: 3 advisories

Findings

1. RUSTSEC-2024-0381: pqcrypto-kyber unmaintained ⚠️

Severity: Warning (Unmaintained)
Crate: pqcrypto-kyber v0.8.1
Title: Replaced by pqcrypto-mlkem
Date: 2024-10-24
URL: https://rustsec.org/advisories/RUSTSEC-2024-0381

Affected Components:

  • icn-crypto-pq (post-quantum cryptography crate)
  • Used by: icn-zkp, icn-steward, icn-identity, icn-gateway

Impact: Low - Not a security vulnerability, but crate is unmaintained

Recommendation: Migrate to pqcrypto-mlkem

Action Plan:

# In icn/crates/icn-crypto-pq/Cargo.toml
# Replace:
pqcrypto-kyber = "0.8.1"
# With:
pqcrypto-mlkem = "0.1"  # Check latest version

Priority: Medium (next sprint)
Effort: 2-4 hours (update imports, test compatibility)

2. RUSTSEC-2024-0370: proc-macro-error unmaintained ⚠️

Severity: Warning (Unmaintained)
Crate: proc-macro-error v1.0.4
Title: proc-macro-error is unmaintained
Date: 2024-09-01
URL: https://rustsec.org/advisories/RUSTSEC-2024-0370

Dependency Chain:

proc-macro-error 1.0.4
└── i18n-embed-fl 0.7.0
    └── age 0.10.1
        └── icn-identity 0.1.0

Affected Components:

  • age crate (used for keystore encryption in icn-identity)
  • Transitive dependency (not directly used)

Impact: Low - Indirect dependency, not directly exploitable

Recommendation:

  1. Check if age crate has updated to remove this dependency
  2. Consider alternative keystore encryption if needed
  3. Monitor for age updates

Action Plan:

# Check for age crate updates
cargo update -p age
cargo test -p icn-identity

# If no update available, track upstream:
# https://github.com/str4d/rage/issues

Priority: Low (monitor)
Effort: 1 hour (track upstream, test updates)

3. RUSTSEC-2025-0134: rustls-pemfile unmaintained ⚠️

Severity: Warning (Unmaintained)
Crate: rustls-pemfile v1.0.4
Title: rustls-pemfile is unmaintained
Date: 2025-11-28
URL: https://rustsec.org/advisories/RUSTSEC-2025-0134

Dependency Chain:

rustls-pemfile 1.0.4
└── reqwest 0.11.27
    ├── icnctl 0.1.0
    ├── icn-gateway 0.1.0
    └── icn-console 0.1.0

Affected Components:

  • reqwest crate (HTTP client)
  • Used in: icnctl, icn-gateway, icn-console

Impact: Low - Transitive dependency, likely to be updated by reqwest

Recommendation:

  1. Update reqwest to latest version (may already fix this)
  2. rustls-pemfile v2.x is the maintained fork

Action Plan:

# Check reqwest version
cargo update -p reqwest
cargo test --workspace

# If reqwest doesn't update, check if v2 is available
# rustls-pemfile = "2.0"

Priority: Medium (next sprint)
Effort: 30 minutes (cargo update + test)

Action Plan Summary

Immediate (This Week)

  • Update reqwest to latest version
  • Test all affected crates after update

Short-term (Next Sprint)

  • Migrate pqcrypto-kyber → pqcrypto-mlkem
  • Test post-quantum crypto functions
  • Update documentation

Long-term (Monitor)

  • Track age crate for proc-macro-error removal
  • Consider alternative keystore encryption if needed

CI Integration

The new security audit job in CI will catch these automatically:

security:
  name: Security Audit
  steps:
    - name: Run security audit
      run: cargo audit
      continue-on-error: true  # Don't fail CI yet

Recommendation: After addressing all advisories, set continue-on-error: false

Severity Assessment

Overall Risk: LOW ✅

All three advisories are "unmaintained" warnings, not active security vulnerabilities. No immediate action required for production deployment, but should be addressed in next development cycle.

Production Impact: None - Safe to deploy with current dependencies

Next Steps

  1. Create GitHub issues for each advisory
  2. Schedule fixes in next sprint
  3. Re-run cargo audit after each fix
  4. Update this report when resolved

References

Report Maintainer: Security Team
Next Audit: Weekly (automated via CI)
Document Version: 1.0

← Back to Docs