Deps.rs

cargo 0.70.1

[![dependency status](https://deps.rs/crate/cargo/0.70.1/status.svg)](https://deps.rs/crate/cargo/0.70.1)

This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate cargo

Dependencies

(60 total, 19 outdated, 2 possibly insecure)

CrateRequiredLatestStatus
 anyhow^1.0.471.0.98up to date
 base64^0.13.10.22.1out of date
 bytesize^1.02.0.1out of date
 cargo-platform^0.1.20.3.0out of date
 cargo-util^0.2.30.2.21up to date
 clap^4.1.34.5.40up to date
 crates-io^0.36.00.40.11out of date
 curl^0.4.440.4.48up to date
 curl-sys^0.4.590.4.82+curl-8.14.1up to date
 env_logger^0.10.00.11.8out of date
 filetime^0.2.90.2.25up to date
 flate2^1.0.31.1.2up to date
 fwdansi^1.1.01.1.0up to date
 git2^0.16.00.20.2out of date
 git2-curl^0.17.00.21.0out of date
 glob^0.3.00.3.2up to date
 hex^0.40.4.3up to date
 hmac^0.12.10.12.1up to date
 home^0.50.5.11up to date
 http-auth^0.1.60.1.10up to date
 humantime^2.0.02.2.0up to date
 ignore^0.4.70.4.23up to date
 im-rc^15.0.015.1.0up to date
 indexmap^12.10.0out of date
 is-terminal^0.4.40.4.16up to date
 itertools^0.10.00.14.0out of date
 jobserver^0.1.260.1.33up to date
 lazy_static^1.2.01.5.0up to date
 lazycell^1.2.01.3.0up to date
 libc^0.20.2.174up to date
 libgit2-sys ⚠️=0.14.10.18.2+1.9.1out of date
 log^0.4.60.4.27up to date
 memchr^2.1.32.7.5up to date
 opener^0.50.8.2out of date
 openssl ⚠️^0.10.110.10.73maybe insecure
 os_info^3.5.03.12.0up to date
 pasetors^0.6.40.7.6out of date
 pathdiff^0.20.2.3up to date
 pretty_env_logger^0.40.5.0out of date
 rustc-workspace-hack^1.0.01.0.0up to date
 rustfix^0.6.00.9.1out of date
 semver^1.0.31.0.26up to date
 serde^1.0.1231.0.219up to date
 serde-value^0.7.00.7.0up to date
 serde_ignored^0.1.00.1.12up to date
 serde_json^1.0.301.0.140up to date
 sha1^0.10.50.10.6up to date
 shell-escape^0.1.40.1.5up to date
 strip-ansi-escapes^0.1.00.2.1out of date
 tar^0.4.380.4.44up to date
 tempfile^3.03.20.0up to date
 termcolor^1.11.4.1up to date
 time^0.30.3.41up to date
 toml^0.7.00.8.23out of date
 toml_edit^0.19.00.22.27out of date
 unicode-width^0.1.50.2.1out of date
 unicode-xid^0.2.00.2.6up to date
 url^2.2.22.5.4up to date
 walkdir^2.22.5.0up to date
 windows-sys^0.450.60.2out of date

Dev dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 same-file^1.0.61.0.6up to date
 snapbox^0.4.00.6.21out of date

Security Vulnerabilities

libgit2-sys: git2 does not verify SSH keys by default

RUSTSEC-2023-0003

The git2 and libgit2-sys crates are Rust wrappers around the libgit2 C library. It was discovered that libgit2 1.5.0 and below did not verify SSH host keys when establishing an SSH connection, exposing users of the library to Man-In-the-Middle attacks.

The libgit2 team assigned CVE-2023-22742 to this vulnerability. The following versions of the libgit2-sys Rust crate have been released:

  • libgit2-sys 0.14.2, updating the underlying libgit2 C library to version 1.5.1.
  • libgit2-sys 0.13.5, updating the underlying libgit2 C library to version 1.4.5.

A new git2 crate version has also been released, 0.16.1. This version only bumps its libgit2-sys dependency to ensure no vulnerable libgit2-sys versions are used, but contains no code changes: if you update the libgit2-sys version there is no need to also update the git2 crate version.

You can learn more about this vulnerability in libgit2's advisory

libgit2-sys: Memory corruption, denial of service, and arbitrary code execution in libgit2

RUSTSEC-2024-0013

The libgit2 project fixed three security issues in the 1.7.2 release. These issues are:

  • The git_revparse_single function can potentially enter an infinite loop on a well-crafted input, potentially causing a Denial of Service. This function is exposed in the git2 crate via the Repository::revparse_single method.
  • The git_index_add function may cause heap corruption and possibly lead to arbitrary code execution. This function is exposed in the git2 crate via the Index::add method.
  • The smart transport negotiation may experience an out-of-bounds read when a remote server did not advertise capabilities.

The libgit2-sys crate bundles libgit2, or optionally links to a system libgit2 library. In either case, versions of the libgit2 library less than 1.7.2 are vulnerable. The 0.16.2 release of libgit2-sys bundles the fixed version of 1.7.2, and requires a system libgit2 version of at least 1.7.2.

It is recommended that all users upgrade.

openssl: Use-After-Free in `Md::fetch` and `Cipher::fetch`

RUSTSEC-2025-0022

When a Some(...) value was passed to the properties argument of either of these functions, a use-after-free would result.

In practice this would nearly always result in OpenSSL treating the properties as an empty string (due to CString::drop's behavior).

The maintainers thank quitbug for reporting this vulnerability to us.