Affected versions of this crate called Vec::reserve() on user-supplied input.
This allows an attacker to cause an Out of Memory condition while calling the vulnerable method on untrusted data.
This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.
grpcio-compiler(6 total, 5 outdated, 2 possibly insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| derive-new | ^0.5 | 0.7.0 | out of date |
| prost | ^0.6 | 0.13.3 | out of date |
| prost-build | ^0.6 | 0.13.3 | out of date |
| prost-types ⚠️ | ^0.6 | 0.13.3 | out of date |
| protobuf ⚠️ | ^2 | 3.7.1 | out of date |
| tempfile | ^3.0 | 3.13.0 | up to date |
protobuf: Out of Memory in stream::read_raw_bytes_into()Affected versions of this crate called Vec::reserve() on user-supplied input.
This allows an attacker to cause an Out of Memory condition while calling the vulnerable method on untrusted data.
prost-types: Conversion from `prost_types::Timestamp` to `SystemTime` can cause an overflow and panicAffected versions of this crate contained a bug in which untrusted input could cause an overflow and panic when converting a Timestamp to SystemTime.
It is recommended to upgrade to prost-types v0.8 and switch the usage of From<Timestamp> for SystemTime to TryFrom<Timestamp> for SystemTime.
See #438 for more information.