Deps.rs

cargo 0.30.0

[![dependency status](https://deps.rs/crate/cargo/0.30.0/status.svg)](https://deps.rs/crate/cargo/0.30.0)

This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate cargo

Dependencies

(43 total, 18 outdated, 1 insecure)

CrateRequiredLatestStatus
 atty^0.20.2.14up to date
 clap^2.31.24.6.7out of date
 core-foundation^0.6.00.10.1out of date
 crates-io^0.180.41.1out of date
 crossbeam-utils^0.50.8.23out of date
 crypto-hash^0.3.10.3.4up to date
 curl^0.4.130.4.50up to date
 env_logger^0.5.40.11.11out of date
 failure^0.1.20.1.8up to date
 filetime^0.20.2.29up to date
 flate2^1.01.1.10up to date
 fs2^0.40.4.3up to date
 git2^0.7.30.21.0out of date
 git2-curl^0.8.10.22.0out of date
 glob^0.2.110.3.4out of date
 hex^0.30.4.3out of date
 home^0.30.5.12out of date
 ignore^0.40.4.33up to date
 jobserver^0.1.110.1.35up to date
 lazy_static^1.0.01.5.0up to date
 lazycell^1.01.3.0up to date
 libc^0.20.2.189up to date
 libgit2-sys ⚠️^0.7.50.18.8+1.9.7insecure
 log^0.40.4.34up to date
 miow^0.3.10.6.1out of date
 num_cpus^1.01.17.0up to date
 openssl^0.10.110.10.81up to date
 rustc-workspace-hack^1.0.01.0.0up to date
 rustfix^0.4.20.9.7out of date
 same-file^11.0.6up to date
 semver^0.9.01.0.28out of date
 serde^1.01.0.229up to date
 serde_derive^1.01.0.229up to date
 serde_ignored^0.0.40.1.14out of date
 serde_json^1.01.0.151up to date
 shell-escape^0.10.1.5up to date
 tar^0.4.150.4.46up to date
 tempfile^3.03.27.0up to date
 termcolor^1.01.4.1up to date
 toml^0.4.21.1.6+spec-1.1.0out of date
 unicode-width^0.1.50.2.2out of date
 url^1.12.5.8out of date
 winapi^0.30.3.9up to date

Dev dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 bufstream^0.10.1.4up to date

Security Vulnerabilities

libgit2-sys: git2 does not verify SSH keys by default

RUSTSEC-2023-0003

The git2 and libgit2-sys crates are Rust wrappers around the libgit2 C library. It was discovered that libgit2 1.5.0 and below did not verify SSH host keys when establishing an SSH connection, exposing users of the library to Man-In-the-Middle attacks.

The libgit2 team assigned CVE-2023-22742 to this vulnerability. The following versions of the libgit2-sys Rust crate have been released:

  • libgit2-sys 0.14.2, updating the underlying libgit2 C library to version 1.5.1.
  • libgit2-sys 0.13.5, updating the underlying libgit2 C library to version 1.4.5.

A new git2 crate version has also been released, 0.16.1. This version only bumps its libgit2-sys dependency to ensure no vulnerable libgit2-sys versions are used, but contains no code changes: if you update the libgit2-sys version there is no need to also update the git2 crate version.

You can learn more about this vulnerability in libgit2's advisory

libgit2-sys: Memory corruption, denial of service, and arbitrary code execution in libgit2

RUSTSEC-2024-0013

The libgit2 project fixed three security issues in the 1.7.2 release. These issues are:

  • The git_revparse_single function can potentially enter an infinite loop on a well-crafted input, potentially causing a Denial of Service. This function is exposed in the git2 crate via the Repository::revparse_single method.
  • The git_index_add function may cause heap corruption and possibly lead to arbitrary code execution. This function is exposed in the git2 crate via the Index::add method.
  • The smart transport negotiation may experience an out-of-bounds read when a remote server did not advertise capabilities.

The libgit2-sys crate bundles libgit2, or optionally links to a system libgit2 library. In either case, versions of the libgit2 library less than 1.7.2 are vulnerable. The 0.16.2 release of libgit2-sys bundles the fixed version of 1.7.2, and requires a system libgit2 version of at least 1.7.2.

It is recommended that all users upgrade.