This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.
calcard(11 total, 1 possibly insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| ahash | ^0.8.11 | 0.8.12 | up to date |
| chrono | ^0.4.40 | 0.4.44 | up to date |
| chrono-tz | ^0.10.3 | 0.10.4 | up to date |
| hashify | ^0.2.7 | 0.2.9 | up to date |
| jmap-tools | ^0.1 | 0.1.4 | up to date |
| mail-builder | ^0.4 | 0.4.4 | up to date |
| mail-parser | ^0.11 | 0.11.2 | up to date |
| rkyv ⚠️ | ^0.8 | 0.8.15 | maybe insecure |
| serde | ^1.0 | 1.0.228 | up to date |
| serde_json | ^1.0 | 1.0.149 | up to date |
| uuid | ^1.19 | 1.23.0 | up to date |
(4 total, 2 possibly insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| chrono ⚠️ | ^0.4 | 0.4.44 | maybe insecure |
| rkyv ⚠️ | ^0.8 | 0.8.15 | maybe insecure |
| serde | ^1.0 | 1.0.228 | up to date |
| serde_json | ^1.0 | 1.0.149 | up to date |
chrono: Potential segfault in `localtime_r` invocationsUnix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.
No workarounds are known.
rkyv: Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOMThe SharedPointer::alloc implementation for sync::Arc<T> and rc::Rc<T> in rkyv/src/impls/alloc/rc/atomic.rs (and rc.rs) does not check if the allocator returns a null pointer on OOM (Out of Memory).
This null pointer can flow through to SharedPointer::from_value, which calls Box::from_raw(ptr) with the null pointer. This triggers undefined behavior when utilizing safe deserialization APIs (such as rkyv::from_bytes or rkyv::deserialize_using) if an OOM condition occurs during the allocation of the shared pointer.
The issue is reachable through safe code and violates Rust's safety guarantees.