Potential vulnerability due to quinn-proto dependency crate

[snehilzs]

Describe the bug

Code audit shows potential vulnerability from the quinn-proto dependency crate. Receiving QUIC frames containing a frame with unknown frame type could lead to a panic.

Details are:
Crate: quinn-proto
Version: 0.10.4
Title: Denial of service in Quinn servers
Date: 2023-09-21
ID: RUSTSEC-2023-0063
URL: https://rustsec.org/advisories/RUSTSEC-2023-0063
Severity: 7.5 (high)

Solution: Upgrade to ^0.9.5 OR >=0.10.5

To reproduce

NA

System info

NA

[wyfo]

@oteffahi Is this issue still relevant?

[oteffahi]

@wyfo We're still using that version of the crate; so the issue is still relevant.

[wyfo]

Should we move it to the origin repository?

[oteffahi]

We shouldn't put security vulnerabilities in the spotlight before we resolve them 😅

[oteffahi]

@gabrik can we bump Quinn?

[gabrik]

@gabrik can we bump Quinn?

sure, but I think it will have a impact on the QUIC transport, as there have been API changes in quinn, so it is not just a bump of the crate

[wyfo]

We shouldn't put security vulnerabilities in the spotlight before we resolve them 😅

Mouais...

[oteffahi]

Fixed by updating crate version in eclipse-zenoh#1086