This project contains known security vulnerabilities. Find detailed information at the bottom.
exonum-testkit(12 total, 6 outdated, 2 insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| actix-web ⚠️ | ^0.7.18 | 4.19.0 | insecure |
| exonum | ^0.11.0 | 1.0.0 | out of date |
| failure | ^0.1.5 | 0.1.8 | up to date |
| futures | ^0.1.25 | 0.3.34 | out of date |
| log | ^0.4.6 | 0.4.35 | up to date |
| protobuf ⚠️ | ^2.4.0 | 3.7.2 | insecure |
| reqwest | ^0.9.8 | 0.13.5 | out of date |
| serde | ^1.0.10 | 1.0.229 | up to date |
| serde_derive | ^1.0.10 | 1.0.229 | up to date |
| serde_json | ^1.0.2 | 1.0.154 | up to date |
| serde_urlencoded | ^0.5.4 | 0.7.1 | out of date |
| tokio-core | ^0.1.17 | 0.1.18 | up to date |
(7 total, 5 outdated, 1 insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| assert_matches | ^1.2.0 | 1.5.0 | up to date |
| exonum-derive | ^0.11.0 | 1.0.0 | out of date |
| hex | ^0.3.2 | 0.4.3 | out of date |
| lazy_static | ^1.0.0 | 1.5.1 | up to date |
| pretty_assertions | ^0.6.1 | 1.4.1 | out of date |
| rand | ^0.6.4 | 0.10.3 | out of date |
| thread_local ⚠️ | ^0.3.6 | 1.1.10 | insecure |
actix-web: Multiple memory safety issuesAffected versions contain multiple memory safety issues, such as:
Send marker trait to objects that cannot be safely sent between threadsThis may result in a variety of memory corruption scenarios, most likely use-after-free.
A significant refactoring effort has been conducted to resolve these issues.
thread_local: Data race in `Iter` and `IterMut`In the affected version of this crate, {Iter, IterMut}::next used a weaker memory ordering when loading values than what was required, exposing a potential data race
when iterating over a ThreadLocal's values.
Crates using Iter::next, or IterMut::next are affected by this issue.
protobuf: Crash due to uncontrolled recursion in protobuf crateAffected version of this crate did not properly parse unknown fields when parsing a user-supplied input.
This allows an attacker to cause a stack overflow when parsing the mssage on untrusted data.
actix-web: Compressed request bodies can exhaust memory before extractor limits applyBody extractors do not pass their size limits to the decompression layer. A small compressed request can therefore cause a large allocation before the extractor rejects the decoded body. A remote attacker can use this to exhaust memory or CPU resources and cause denial of service.
This affects applications that read compressed request bodies with the corresponding compression feature enabled.
Upgrade to actix-web 4.18.2 or later with actix-http 3.20.1 or later. As a workaround, reject compressed request bodies at a reverse proxy or in middleware before body extraction.