This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate cargo

Dependencies

(53 total, 20 outdated, 3 possibly insecure)

CrateRequiredLatestStatus
 atty^0.20.2.14up to date
 byteorder^1.21.5.0up to date
 bytesize^1.01.3.0up to date
 clap^2.31.24.5.4out of date
 core-foundation^0.6.00.9.4out of date
 crates-io^0.260.40.0out of date
 crossbeam-utils^0.60.8.19out of date
 crypto-hash^0.3.10.3.4up to date
 curl^0.4.210.4.46up to date
 curl-sys^0.4.180.4.72+curl-8.6.0up to date
 env_logger^0.6.00.11.3out of date
 failure^0.1.50.1.8up to date
 filetime^0.20.2.23up to date
 flate2^1.0.31.0.28up to date
 fs2^0.40.4.3up to date
 fwdansi^11.1.0up to date
 git2^0.9.00.18.3out of date
 git2-curl^0.10.00.19.0out of date
 glob^0.3.00.3.1up to date
 hex^0.30.4.3out of date
 home^0.30.5.9out of date
 ignore^0.4.70.4.22up to date
 im-rc^13.0.015.1.0out of date
 jobserver^0.1.130.1.28up to date
 lazy_static^1.2.01.4.0up to date
 lazycell^1.2.01.3.0up to date
 libc^0.20.2.153up to date
 libgit2-sys ⚠️^0.8.00.16.2+1.7.2out of date
 log^0.4.60.4.21up to date
 memchr^2.1.32.7.2up to date
 miow^0.3.10.6.0out of date
 num_cpus^1.01.16.0up to date
 opener^0.40.7.0out of date
 openssl ⚠️^0.10.110.10.64maybe insecure
 pretty_env_logger^0.30.5.0out of date
 rustc-workspace-hack^1.0.01.0.0up to date
 rustfix^0.4.40.8.1out of date
 same-file^11.0.6up to date
 semver^0.9.01.0.22out of date
 serde^1.0.821.0.197up to date
 serde_ignored^0.0.40.1.10out of date
 serde_json^1.0.301.0.115up to date
 shell-escape^0.1.40.1.5up to date
 strip-ansi-escapes^0.1.00.2.0out of date
 tar ⚠️^0.4.180.4.40maybe insecure
 tempfile^3.03.10.1up to date
 termcolor^1.01.4.1up to date
 toml^0.5.00.8.12out of date
 unicode-width^0.1.50.1.11up to date
 url^1.12.5.0out of date
 url_serde^0.2.00.2.0up to date
 walkdir^2.22.5.0up to date
 winapi^0.30.3.9up to date

Dev dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 bufstream^0.10.1.4up to date

Security Vulnerabilities

tar: Links in archive can create arbitrary directories

RUSTSEC-2021-0080

When unpacking a tarball that contains a symlink the tar crate may create directories outside of the directory it's supposed to unpack into.

The function errors when it's trying to create a file, but the folders are already created at this point.

use std::{io, io::Result};
use tar::{Archive, Builder, EntryType, Header};

fn main() -> Result<()> {
    let mut buf = Vec::new();

    {
        let mut builder = Builder::new(&mut buf);

        // symlink: parent -> ..
        let mut header = Header::new_gnu();
        header.set_path("symlink")?;
        header.set_link_name("..")?;
        header.set_entry_type(EntryType::Symlink);
        header.set_size(0);
        header.set_cksum();
        builder.append(&header, io::empty())?;

        // file: symlink/exploit/foo/bar
        let mut header = Header::new_gnu();
        header.set_path("symlink/exploit/foo/bar")?;
        header.set_size(0);
        header.set_cksum();
        builder.append(&header, io::empty())?;

        builder.finish()?;
    };

    Archive::new(&*buf).unpack("demo")
}

This has been fixed in https://github.com/alexcrichton/tar-rs/pull/259 and is published as tar 0.4.36. Thanks to Martin Michaelis (@mgjm) for discovering and reporting this, and Nikhil Benesch (@benesch) for the fix!

libgit2-sys: git2 does not verify SSH keys by default

RUSTSEC-2023-0003

The git2 and libgit2-sys crates are Rust wrappers around the libgit2 C library. It was discovered that libgit2 1.5.0 and below did not verify SSH host keys when establishing an SSH connection, exposing users of the library to Man-In-the-Middle attacks.

The libgit2 team assigned CVE-2023-22742 to this vulnerability. The following versions of the libgit2-sys Rust crate have been released:

  • libgit2-sys 0.14.2, updating the underlying libgit2 C library to version 1.5.1.
  • libgit2-sys 0.13.5, updating the underlying libgit2 C library to version 1.4.5.

A new git2 crate version has also been released, 0.16.1. This version only bumps its libgit2-sys dependency to ensure no vulnerable libgit2-sys versions are used, but contains no code changes: if you update the libgit2-sys version there is no need to also update the git2 crate version.

You can learn more about this vulnerability in libgit2's advisory

openssl: `openssl` `X509VerifyParamRef::set_host` buffer over-read

RUSTSEC-2023-0044

When this function was passed an empty string, openssl would attempt to call strlen on it, reading arbitrary memory until it reached a NUL byte.

libgit2-sys: Memory corruption, denial of service, and arbitrary code execution in libgit2

RUSTSEC-2024-0013

The libgit2 project fixed three security issues in the 1.7.2 release. These issues are:

  • The git_revparse_single function can potentially enter an infinite loop on a well-crafted input, potentially causing a Denial of Service. This function is exposed in the git2 crate via the Repository::revparse_single method.
  • The git_index_add function may cause heap corruption and possibly lead to arbitrary code execution. This function is exposed in the git2 crate via the Index::add method.
  • The smart transport negotiation may experience an out-of-bounds read when a remote server did not advertise capabilities.

The libgit2-sys crate bundles libgit2, or optionally links to a system libgit2 library. In either case, versions of the libgit2 library less than 1.7.2 are vulnerable. The 0.16.2 release of libgit2-sys bundles the fixed version of 1.7.2, and requires a system libgit2 version of at least 1.7.2.

It is recommended that all users upgrade.