Deps.rs

cargo 0.70.1

[![dependency status](https://deps.rs/crate/cargo/0.70.1/status.svg)](https://deps.rs/crate/cargo/0.70.1)

This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate cargo

Dependencies

(60 total, 21 outdated, 1 insecure)

CrateRequiredLatestStatus
 anyhow^1.0.471.0.104up to date
 base64^0.13.10.23.1out of date
 bytesize^1.02.7.0out of date
 cargo-platform^0.1.20.3.3out of date
 cargo-util^0.2.30.2.32up to date
 clap^4.1.34.6.7up to date
 crates-io^0.36.00.41.2out of date
 curl^0.4.440.4.51up to date
 curl-sys^0.4.590.4.91+curl-8.22.0up to date
 env_logger^0.10.00.11.11out of date
 filetime^0.2.90.2.29up to date
 flate2^1.0.31.1.11up to date
 fwdansi^1.1.01.1.0up to date
 git2^0.16.00.21.0out of date
 git2-curl^0.17.00.22.0out of date
 glob^0.3.00.3.4up to date
 hex^0.40.4.3up to date
 hmac^0.12.10.13.0out of date
 home^0.50.5.12up to date
 http-auth^0.1.60.1.10up to date
 humantime^2.0.02.4.0up to date
 ignore^0.4.70.4.34up to date
 im-rc^15.0.015.1.0up to date
 indexmap^12.14.2out of date
 is-terminal^0.4.40.4.17up to date
 itertools^0.10.00.15.0out of date
 jobserver^0.1.260.1.35up to date
 lazy_static^1.2.01.5.1up to date
 lazycell^1.2.01.3.0up to date
 libc^0.20.2.191up to date
 libgit2-sys ⚠️=0.14.10.18.8+1.9.7insecure
 log^0.4.60.4.35up to date
 memchr^2.1.32.8.3up to date
 opener^0.50.9.0out of date
 openssl^0.10.110.10.82up to date
 os_info^3.5.03.15.0up to date
 pasetors^0.6.40.8.1out of date
 pathdiff^0.20.2.3up to date
 pretty_env_logger^0.40.5.0out of date
 rustc-workspace-hack^1.0.01.0.0up to date
 rustfix^0.6.00.9.8out of date
 semver^1.0.31.0.28up to date
 serde^1.0.1231.0.229up to date
 serde-value^0.7.00.7.0up to date
 serde_ignored^0.1.00.1.14up to date
 serde_json^1.0.301.0.154up to date
 sha1^0.10.50.11.0out of date
 shell-escape^0.1.40.1.5up to date
 strip-ansi-escapes^0.1.00.2.1out of date
 tar^0.4.380.4.46up to date
 tempfile^3.03.27.0up to date
 termcolor^1.11.4.1up to date
 time^0.30.3.55up to date
 toml^0.7.01.2.1+spec-1.1.0out of date
 toml_edit^0.19.00.25.19+spec-1.1.0out of date
 unicode-width^0.1.50.2.3out of date
 unicode-xid^0.2.00.2.6up to date
 url^2.2.22.5.8up to date
 walkdir^2.22.5.0up to date
 windows-sys^0.450.61.2out of date

Dev dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 same-file^1.0.61.0.6up to date
 snapbox^0.4.01.2.2out of date

Security Vulnerabilities

libgit2-sys: git2 does not verify SSH keys by default

RUSTSEC-2023-0003

The git2 and libgit2-sys crates are Rust wrappers around the libgit2 C library. It was discovered that libgit2 1.5.0 and below did not verify SSH host keys when establishing an SSH connection, exposing users of the library to Man-In-the-Middle attacks.

The libgit2 team assigned CVE-2023-22742 to this vulnerability. The following versions of the libgit2-sys Rust crate have been released:

  • libgit2-sys 0.14.2, updating the underlying libgit2 C library to version 1.5.1.
  • libgit2-sys 0.13.5, updating the underlying libgit2 C library to version 1.4.5.

A new git2 crate version has also been released, 0.16.1. This version only bumps its libgit2-sys dependency to ensure no vulnerable libgit2-sys versions are used, but contains no code changes: if you update the libgit2-sys version there is no need to also update the git2 crate version.

You can learn more about this vulnerability in libgit2's advisory

libgit2-sys: Memory corruption, denial of service, and arbitrary code execution in libgit2

RUSTSEC-2024-0013

The libgit2 project fixed three security issues in the 1.7.2 release. These issues are:

  • The git_revparse_single function can potentially enter an infinite loop on a well-crafted input, potentially causing a Denial of Service. This function is exposed in the git2 crate via the Repository::revparse_single method.
  • The git_index_add function may cause heap corruption and possibly lead to arbitrary code execution. This function is exposed in the git2 crate via the Index::add method.
  • The smart transport negotiation may experience an out-of-bounds read when a remote server did not advertise capabilities.

The libgit2-sys crate bundles libgit2, or optionally links to a system libgit2 library. In either case, versions of the libgit2 library less than 1.7.2 are vulnerable. The 0.16.2 release of libgit2-sys bundles the fixed version of 1.7.2, and requires a system libgit2 version of at least 1.7.2.

It is recommended that all users upgrade.