This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate actix-tls

Dependencies

(19 total, 3 outdated, 2 possibly insecure)

CrateRequiredLatestStatus
 actix-rt^2.22.10.0up to date
 actix-service^22.0.2up to date
 actix-utils^33.0.1up to date
 futures-core^0.3.70.3.31up to date
 http^11.1.0up to date
 impl-more^0.10.1.6up to date
 pin-project-lite^0.2.70.2.14up to date
 rustls ⚠️^0.21.60.23.14out of date
 rustls-native-certs^0.70.8.0out of date
 rustls-pki-types^11.9.0up to date
 rustls-webpki^0.101.40.102.8out of date
 openssl ⚠️^0.10.550.10.66maybe insecure
 tokio^1.23.11.40.0up to date
 tokio-native-tls^0.30.3.1up to date
 tokio-openssl^0.60.6.5up to date
 tokio-rustls^0.260.26.0up to date
 tokio-util^0.70.7.12up to date
 tracing^0.1.300.1.40up to date
 webpki-roots^0.260.26.6up to date

Dev dependencies

(11 total, 2 outdated)

CrateRequiredLatestStatus
 actix-codec^0.50.5.2up to date
 actix-rt^2.22.10.0up to date
 actix-server^22.5.0up to date
 bytes^11.7.2up to date
 futures-util^0.3.170.3.31up to date
 itertools^0.120.13.0out of date
 pretty_env_logger^0.50.5.0up to date
 rcgen^0.120.13.1out of date
 rustls-pemfile^22.2.0up to date
 tokio-rustls^0.260.26.0up to date
 trust-dns-resolver^0.230.23.2up to date

Security Vulnerabilities

rustls: `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input

RUSTSEC-2024-0336

If a close_notify alert is received during a handshake, complete_io does not terminate.

Callers which do not call complete_io are not affected.

rustls-tokio and rustls-ffi do not call complete_io and are not affected.

rustls::Stream and rustls::StreamOwned types use complete_io and are affected.

openssl: `MemBio::get_buf` has undefined behavior with empty buffers

RUSTSEC-2024-0357

Previously, MemBio::get_buf called slice::from_raw_parts with a null-pointer, which violates the functions invariants, leading to undefined behavior. In debug builds this would produce an assertion failure. This is now fixed.