This project contains known security vulnerabilities. Find detailed information at the bottom.
chrono(11 total, 3 outdated, 1 insecure, 1 possibly insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| android-tzdata | ^0.1.1 | 0.1.1 | up to date |
| arbitrary | ^1.0.0 | 1.4.2 | up to date |
| iana-time-zone | ^0.1.45 | 0.1.65 | up to date |
| js-sys | ^0.3 | 0.3.104 | up to date |
| num-traits | ^0.2 | 0.2.19 | up to date |
| pure-rust-locales | ^0.6 | 0.8.2 | out of date |
| rkyv ⚠️ | ^0.7 | 0.8.18 | out of date |
| rustc-serialize ⚠️ | ^0.3.20 | 0.3.25 | insecure |
| serde | ^1.0.99 | 1.0.229 | up to date |
| wasm-bindgen | ^0.2 | 0.2.127 | up to date |
| windows-targets | ^0.48 | 0.53.5 | out of date |
(6 total, 2 outdated)
| Crate | Required | Latest | Status |
|---|---|---|---|
| bincode | ^1.3.0 | 3.0.0 | out of date |
| doc-comment | ^0.3 | 0.3.4 | up to date |
| serde_derive | ^1 | 1.0.229 | up to date |
| serde_json | ^1 | 1.0.151 | up to date |
| wasm-bindgen-test | ^0.3 | 0.3.77 | up to date |
| windows-bindgen | ^0.51 | 0.66.0 | out of date |
rustc-serialize: Stack overflow in rustc_serialize when parsing deeply nested JSONWhen parsing JSON using json::Json::from_str, there is no limit to the depth of the stack, therefore deeply nested objects can cause a stack overflow, which aborts the process.
Example code that triggers the vulnerability is
fn main() {
let _ = rustc_serialize::json::Json::from_str(&"[0,[".repeat(10000));
}
serde is recommended as a replacement to rustc_serialize.
rkyv: Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/ArcShared pointer validation keyed already-validated pointees by their address and
type, but did not include pointer metadata. For unsized pointees, an archive
could therefore contain multiple Rc, Arc, or weak pointers that shared a
data address but used different metadata, such as different slice lengths.
Once the first pointer had been validated, later pointers to the same address
skipped pointee validation. The safe checked rkyv::access API could
consequently return a slice with a forged length, allowing safe indexing to
read out of bounds. The same validation bypass was reachable through checked
deserialization with rkyv::from_bytes.
Version 0.8.17 includes pointer metadata in shared pointer validation and rejects conflicting metadata. The 0.7 series is also affected but is no longer supported by upstream. Users who process untrusted archives should upgrade to 0.8.17 or later.