Update RUSTSEC-0000-0000.md

Update w/Alex's feedback.

Author: mmastrac

crates/openssl-probe/RUSTSEC-0000-0000.md

@@ -12,7 +12,7 @@ keywords = ["ssl", "openssl", "environment"]
 
 [affected.functions]
 "openssl_probe::try_init_ssl_cert_env_vars" = ["< 0.1.6"]
-
+"
 [affected]
 os = ["linux"]
 
@@ -33,15 +33,26 @@ added, or a variable's contents being enlarged.
 This is shown to occur on Linux, but it will also likely occur on any other platform where `getenv`
 and `setenv` are not thread-safe, though trigger conditions may vary widely.
 
+## Rust's `set_env`
+
+This crate, and all callers of the Rust `set_env` function (<https://doc.rust-lang.org/std/env/fn.set_var.html>)
+are unsound due to some early decisions in the Rust ecosystem that provided these functions without
+an `unsafe` marker. The real problem, however, lies in the POSIX standard which defines this method
+without making any sort of thread-safety guarantees.
+
+In Rust's 2024 edition these environment setters are made `unsafe` and the documentation was updated to note
+that the only safe way to use these functions is in a single-threaded context.
+
 ## Affected Code
 
-The affected function is `try_init_ssl_cert_env_vars` in 
-<https://github.com/alexcrichton/openssl-probe/blob/db67c9e5b333b1b4164467b17f5d99207fad004c/src/lib.rs#L65>, and
+The affected functions are `init_ssl_cert_env_vars` and `try_init_ssl_cert_env_vars` in 
+<https://github.com/alexcrichton/openssl-probe/blob/db67c9e5b333b1b4164467b17f5d99207fad004c/src/lib.rs#L52> and <https://github.com/alexcrichton/openssl-probe/blob/db67c9e5b333b1b4164467b17f5d99207fad004c/src/lib.rs#L65>, respectively, and
 any other library's function which may call this function directly or indirectly
-<https://github.com/search?q=try_init_ssl_cert_env_vars&type=code>.  `native_tls <= 0.2.12` may
+<[https://github.com/search?q=try_init_ssl_cert_env_vars&type=code](https://github.com/search?q=try_init_ssl_cert_env_vars+OR+init_ssl_cert_env_vars&type=code)>.  `native_tls <= 0.2.12` may
 do so in certain configurations <https://github.com/sfackler/rust-native-tls/blob/2424bc5efd1b8b4bcf60dbda93259a3f29db7f06/Cargo.toml>.
 
-The crate's author released a fix in versions `>=0.1.6` which marks these functions as `unsafe` and `#[deprecated]`.
+The crate's author released a fix in versions `>=0.1.6` which marks these functions as `#[deprecated]` and adds
+new `unsafe` equivalents <https://github.com/alexcrichton/openssl-probe/commit/3ea7c1af24d7f03c5786872f06ff066e03b75138>.
 
 ## Alternative Mitigations