This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate card_catalog

Dependencies

(7 total, 5 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 clap^2.33.04.5.4out of date
 config^0.9.20.14.0out of date
 diesel ⚠️^1.4.22.1.5out of date
 dotenv^0.13.00.15.0out of date
 twox-hash^1.2.01.6.3up to date
 uuid^0.7.41.8.0out of date
 walkdir^2.2.72.5.0up to date

Security Vulnerabilities

diesel: Fix a use-after-free bug in diesels Sqlite backend

RUSTSEC-2021-0037

We've misused sqlite3_column_name. The SQLite documentation states that the following:

The returned string pointer is valid until either the prepared statement is destroyed by sqlite3_finalize() or until the statement is automatically reprepared by the first call to sqlite3_step() for a particular run or until the next call to sqlite3_column_name() or sqlite3_column_name16() on the same column.

As part of our query_by_name infrastructure we've first received all field names for the prepared statement and stored them as string slices for later use. After that we called sqlite3_step() for the first time, which invalids the pointer and therefore the stored string slice.