This project contains known security vulnerabilities. Find detailed information at the bottom.
arrow(13 total, 4 outdated, 1 insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| chrono | ^0.4 | 0.4.45 | up to date |
| csv | ^1.0 | 1.4.0 | up to date |
| flatbuffers ⚠️ | ^0.5.0 | 25.12.19 | insecure |
| indexmap | ^1.0 | 2.14.2 | out of date |
| lazy_static | ^1.2 | 1.5.0 | up to date |
| libc | ^0.2 | 0.2.189 | up to date |
| num | ^0.2 | 0.4.3 | out of date |
| packed_simd | ^0.3.1 | 0.3.9 | up to date |
| rand | ^0.6 | 0.10.3 | out of date |
| regex | ^1.1 | 1.13.1 | up to date |
| serde | ^1.0.80 | 1.0.229 | up to date |
| serde_derive | ^1.0.80 | 1.0.229 | up to date |
| serde_json | ^1.0.13 | 1.0.151 | up to date |
(2 total, 1 outdated)
| Crate | Required | Latest | Status |
|---|---|---|---|
| criterion | ^0.2 | 0.8.2 | out of date |
| lazy_static | ^1 | 1.5.0 | up to date |
flatbuffers: Unsound `impl Follow for bool`The implementation of impl Follow for bool allows to reinterpret arbitrary bytes as a bool.
In Rust bool has stringent requirements for its in-memory representation. Use of this function
allows to violate these requirements and invoke undefined behaviour in safe code.
flatbuffers: `read_scalar` and `read_scalar_at` allow transmuting values without `unsafe` blocksThe read_scalar and read_scalar_at functions are unsound
because they allow transmuting values without unsafe blocks.
The following example shows how to create a dangling reference:
fn main() {
#[derive(Copy, Clone, PartialEq, Debug)]
struct S(&'static str);
impl flatbuffers::EndianScalar for S {
fn to_little_endian(self) -> Self { self }
fn from_little_endian(self) -> Self { self }
}
println!("{:?}", flatbuffers::read_scalar::<S>(&[1; std::mem::size_of::<S>()]));
}
flatbuffers: Generated code can read and write out of bounds in safe codeCode generated by flatbuffers' compiler is unsafe but not marked as such.
See https://github.com/google/flatbuffers/issues/6627 for details.
For example, if generated code is used to decode malformed or untrusted input,
undefined behavior (and thus security vulnerabilities) is possible even without
the use of the unsafe keyword, violating the the meaning of "safe" code;
All users that use generated code by flatbuffers compiler are recommended to:
follow, push, or any method that uses them
(e.g. self_follow).