fix(deps): update rust crate serde to v1.0.215 #186
Security advisories found
2 advisory(ies), 5 unmaintained, 1 other
Details
Vulnerabilities
RUSTSEC-2024-0336
rustls::ConnectionCommon::complete_io
could fall into an infinite loop based on network input
Details | |
---|---|
Package | rustls |
Version | 0.19.1 |
URL | GHSA-6g7w-8wpp-frhj |
Date | 2024-04-19 |
Patched versions | >=0.23.5,>=0.22.4, <0.23.0,>=0.21.11, <0.22.0 |
If a close_notify
alert is received during a handshake, complete_io
does not terminate.
Callers which do not call complete_io
are not affected.
rustls-tokio
and rustls-ffi
do not call complete_io
and are not affected.
rustls::Stream
and rustls::StreamOwned
types use
complete_io
and are affected.
RUSTSEC-2023-0052
webpki: CPU denial of service in certificate path building
Details | |
---|---|
Package | webpki |
Version | 0.21.4 |
Date | 2023-08-22 |
Patched versions | >=0.22.2 |
When this crate is given a pathological certificate chain to validate, it will
spend CPU time exponential with the number of candidate certificates at each
step of path building.
Both TLS clients and TLS servers that accept client certificate are affected.
This was previously reported in
<briansmith/webpki#69> and re-reported recently
by Luke Malinowski.
webpki 0.22.1 included a partial fix and webpki 0.22.2 added further fixes.
Warnings
RUSTSEC-2021-0139
ansi_term is Unmaintained
Details | |
---|---|
Status | unmaintained |
Package | ansi_term |
Version | 0.12.1 |
URL | ogham/rust-ansi-term#72 |
Date | 2021-08-18 |
The maintainer has advised that this crate is deprecated and will not receive any maintenance.
The crate does not seem to have much dependencies and may or may not be ok to use as-is.
Last release seems to have been three years ago.
Possible Alternative(s)
The below list has not been vetted in any way and may or may not contain alternatives;
Dependency Specific Migration(s)
RUSTSEC-2024-0375
atty
is unmaintained
Details | |
---|---|
Status | unmaintained |
Package | atty |
Version | 0.2.14 |
URL | softprops/atty#57 |
Date | 2024-09-25 |
The maintainer of atty
has published an official notice that the crate is no longer
under development, and that users should instead rely on the functionality in the standard library's IsTerminal
trait.
Alternative(s)
- std::io::IsTerminal - Stable since Rust 1.70.0 and the recommended replacement per the
atty
maintainer. - is-terminal - Standalone crate supporting Rust older than 1.70.0
RUSTSEC-2020-0168
mach is unmaintained
Details | |
---|---|
Status | unmaintained |
Package | mach |
Version | 0.1.2 |
URL | fitzgen/mach#63 |
Date | 2020-07-14 |
Last release was almost 4 years ago.
Maintainer(s) seem to be completely unreachable.
Possible Alternative(s)
These may or may not be suitable alternatives and have not been vetted in any way;
- mach2 - direct fork
RUSTSEC-2020-0168
mach is unmaintained
Details | |
---|---|
Status | unmaintained |
Package | mach |
Version | 0.3.2 |
URL | fitzgen/mach#63 |
Date | 2020-07-14 |
Last release was almost 4 years ago.
Maintainer(s) seem to be completely unreachable.
Possible Alternative(s)
These may or may not be suitable alternatives and have not been vetted in any way;
- mach2 - direct fork
RUSTSEC-2024-0370
proc-macro-error is unmaintained
Details | |
---|---|
Status | unmaintained |
Package | proc-macro-error |
Version | 1.0.4 |
URL | https://gitlab.com/CreepySkeleton/proc-macro-error/-/issues/20 |
Date | 2024-09-01 |
proc-macro-error's maintainer seems to be unreachable, with no commits for 2 years, no releases pushed for 4 years, and no activity on the GitLab repo or response to email.
proc-macro-error also depends on syn 1.x
, which may be bringing duplicate dependencies into dependant build trees.