chore(deps): update rust crate serde_with to v3.21.0 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
serde_with	dependencies	minor	3.14.0 → 3.21.0

---

serde_with: KeyValueMap serialization panics on empty sequence or map entries

GHSA-7gcf-g7xr-8hxj

More information

Details

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

• Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
• Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

• serde_with/src/key_value_map.rs:590
• serde_with/src/key_value_map.rs:599
• serde_with/src/key_value_map.rs:613
• serde_with/src/key_value_map.rs:632
• serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]

#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]

#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/jonasbb/serde_with/security/advisories/GHSA-7gcf-g7xr-8hxj
• https://github.com/jonasbb/serde_with/pull/966
• https://github.com/jonasbb/serde_with/commit/c8a1d820ea25df01692b367058d587343e199389
• https://github.com/jonasbb/serde_with/releases/tag/v3.21.0
• https://github.com/advisories/GHSA-7gcf-g7xr-8hxj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

jonasbb/serde_with (serde_with)

v3.21.0: serde_with v3.21.0

Compare Source

Security

• GHSA-7gcf-g7xr-8hxj: KeyValueMap serialization panics on empty sequence or map entries
  Bad or attacker controlled values could cause a panic while allocating too large values.
  Fixed in #​966 by setting a maximum allocation size during the creation of collections like Vec or sets.

  Thanks to @​7thParkk for reporting the issue.

Added

• Add NoneAsZero adapter that maps Option<NonZero*> to a plain integer, encoding None as 0 by @​SAY-5 (#​486)

Changed

• Re-enable link-to-definition on docs.rs (#​964)

Fixed

• Fix some doc links to point to the correct types (#​963)
• Re-enable unused_qualifications and fix the resulting findings by @​lms0806 (#​962)

v3.20.0: serde_with v3.20.0

Compare Source

Added

• Add support for base58 encoding, similar to the existing base64 setup by @​mitinarseny (#​943)

Fixed

• Extend base64 with schemars support by @​mitinarseny (#​9949)

v3.19.0: serde_with v3.19.0

Compare Source

Added

• Add support for hashbrown v0.17 (#​940)

  This extends the existing support for hashbrown to the newly released version.

v3.18.0: serde_with v3.18.0

Compare Source

Added

• Support OneOrMany with more sequence and set types (#​929)

Changed

• Bump MSRV to 1.88 due to the darling dependency

v3.17.0: serde_with v3.17.0

Compare Source

Added

• Support OneOrMany with smallvec v1 (#​920, #​922)

Changed

• Switch to yaml_serde for a maintained yaml dependency by @​kazan417 (#​921)
• Bump MSRV to 1.82, since that is required for yaml_serde dev-dependency.

v3.16.1: serde_with v3.16.1

Compare Source

Fixed

• Fix JsonSchemaAs of SetPreventDuplicates and SetLastValueWins. (#​906, #​907)

v3.16.0: serde_with v3.16.0

Compare Source

Added

• Added support for smallvec v1 under the smallvec_1 feature flag by @​isharma228 (#​895)
• Add JsonSchemaAs implementation for json::JsonString by @​yogevm15 (#​901)

v3.15.1: serde_with v3.15.1

Compare Source

Fixed

• Fix building of the documentation by updating references to use serde_core.

v3.15.0: serde_with v3.15.0

Compare Source

Added

• Added error inspection to VecSkipError and MapSkipError by @​michelhe (#​878)
  This allows interacting with the previously hidden error, for example for logging.
  Checkout the newly added example to both types.

• Allow documenting the types generated by serde_conv!.
  The serde_conv! macro now acceps outer attributes before the optional visibility modifier.
  This allow adding doc comments in the shape of #[doc = "..."] or any other attributes, such as lint modifiers.

  serde_conv!(
      #[doc = "Serialize bools as string"]
      #[allow(dead_code)]
      pub BoolAsString,
      bool,
      |x: &bool| ::std::string::ToString::to_string(x),
      |x: ::std::string::String| x.parse()
  );

• Add support for hashbrown v0.16 (#​877)

  This extends the existing support for hashbrown v0.14 and v0.15 to the newly released version.

Changed

• Bump MSRV to 1.76, since that is required for toml dev-dependency.

v3.14.1: serde_with v3.14.1

Compare Source

Fixed

• Show macro expansion in the docs.rs generated rustdoc.
  Since macros are used to generate trait implementations, this is useful to understand the exact generated code.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.