Possible fix(deps): 5 vulnerable dependencies in Cargo.lock

[begininvoke]

Spotted what might be an issue in asap-tools/execution-utilities/clickhouse-benchmark-pipeline/data_exporter/Cargo.lock around line 1048.

The project pins openssl = 0.10.75 in Cargo.lock. Versions prior to 0.10.78 contain a flaw in Deriver::derive where the buffer length is incorrectly trusted, allowing a short output slice to cause a heap/stack overflow on OpenSSL 1.1.x (affecting X25519, X448, DH, HKDF‑extract). This can be exploited to corrupt memory and potentially achieve code execution. The vulnerability is rated HIGH. Updating to openssl 0.10.78 (or later) removes the unsafe length handling and mitigates the risk.

Something like this might fix it:

*** Begin Patch
*** Update File: asap-tools/execution-utilities/clickhouse-benchmark-pipeline/data_exporter/Cargo.lock
@@
-[[package]]
-name = "openssl"
-version = "0.10.75"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "..."
+[[package]]
+name = "openssl"
+version = "0.10.78"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "..."  # run `cargo update -p openssl` to generate the correct checksum
*** End Patch

*** Begin Patch
*** Update File: asap-tools/execution-utilities/clickhouse-benchmark-pipeline/data_exporter/Cargo.toml
@@
-openssl = "0.10.75"
+openssl = "0.10.78"
*** End Patch

# After applying the changes, run:
#   cargo update -p openssl
#   cargo build
# to ensure the lockfile checksum is refreshed and the project compiles with the patched version.

For reference: rule CVE-2026-41676. Rated high.

The suggested change is untested against this project, so please read it before applying it.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.