Deps.rs

datafusion 20.0.0

[![dependency status](https://deps.rs/crate/datafusion/20.0.0/status.svg)](https://deps.rs/crate/datafusion/20.0.0)

This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate datafusion

Dependencies

(45 total, 21 outdated, 1 insecure)

CrateRequiredLatestStatus
 ahash^0.80.8.12up to date
 apache-avro^0.140.22.0out of date
 arrow^34.0.060.0.0out of date
 async-compression^0.3.140.4.48out of date
 async-trait^0.1.410.1.92up to date
 bytes^1.41.12.1up to date
 bzip2^0.4.30.6.1out of date
 chrono^0.4.230.4.45up to date
 dashmap^5.4.06.2.1out of date
 datafusion-common^20.0.055.1.0out of date
 datafusion-execution^20.0.055.1.0out of date
 datafusion-expr^20.0.055.1.0out of date
 datafusion-jit^20.0.023.0.0out of date
 datafusion-optimizer^20.0.055.1.0out of date
 datafusion-physical-expr^20.0.055.1.0out of date
 datafusion-row^20.0.027.0.0out of date
 datafusion-sql^20.0.055.1.0out of date
 flate2^1.0.241.1.10up to date
 futures^0.30.3.34up to date
 glob^0.3.00.3.4up to date
 hashbrown^0.130.17.1out of date
 indexmap^1.9.22.14.2out of date
 itertools^0.100.15.0out of date
 lazy_static^1.4.01.5.0up to date
 log^0.40.4.34up to date
 num-traits^0.20.2.19up to date
 num_cpus^1.13.01.17.0up to date
 object_store ⚠️^0.5.40.14.2insecure
 parking_lot^0.120.12.5up to date
 parquet^34.0.060.0.0out of date
 paste^1.01.0.15up to date
 percent-encoding^2.2.02.3.2up to date
 pin-project-lite^0.2.70.2.17up to date
 rand^0.80.10.3out of date
 rayon^1.51.12.0up to date
 smallvec^1.61.16.1up to date
 sqlparser^0.320.63.0out of date
 tempfile^33.27.0up to date
 tokio^1.01.53.1up to date
 tokio-stream^0.10.1.19up to date
 tokio-util^0.7.40.7.19up to date
 url^2.22.5.8up to date
 uuid^1.01.26.1up to date
 xz2^0.10.1.7up to date
 zstd^0.120.14.0out of date

Dev dependencies

(16 total, 8 outdated)

CrateRequiredLatestStatus
 async-trait^0.1.530.1.92up to date
 bigdecimal^0.3.00.4.10out of date
 criterion^0.40.8.2out of date
 csv^1.1.61.4.0up to date
 ctor^0.1.221.0.13out of date
 doc-comment^0.30.3.4up to date
 env_logger^0.100.11.11out of date
 half^2.2.12.7.1up to date
 nix^0.26.10.31.3out of date
 postgres-protocol^0.6.40.6.12up to date
 postgres-types^0.2.40.2.14up to date
 rstest^0.16.00.27.0out of date
 rust_decimal^1.27.01.43.0up to date
 sqllogictest^0.13.00.29.1out of date
 thiserror^1.0.372.0.21out of date
 tokio-postgres^0.7.70.7.18up to date

Security Vulnerabilities

object_store: Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files

RUSTSEC-2024-0358

Exposure of temporary credentials in logs in Apache Arrow Rust Object Store, version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens.

On certain error conditions, the logs may contain the OIDC token passed to AssumeRoleWithWebIdentity. This allows someone with access to the logs to impersonate that identity, including performing their own calls to AssumeRoleWithWebIdentity, until the OIDC token expires. Typically OIDC tokens are valid for up to an hour, although this will vary depending on the issuer.

Users are recommended to use a different AWS authentication mechanism, disable logging or upgrade to version 0.10.2, which fixes this issue.

Details

When using AWS WebIdentityTokens with the object_store crate, in the event of a failure and automatic retry, the underlying reqwest error, including the full URL with the credentials, potentially in the parameters, is written to the logs.

Thanks to Paul Hatcherian for reporting this vulnerability