Deps.rs

lettre 0.11.15

[![dependency status](https://deps.rs/crate/lettre/0.11.15/status.svg)](https://deps.rs/crate/lettre/0.11.15)

This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate lettre

Dependencies

(36 total, 9 outdated, 1 insecure)

CrateRequiredLatestStatus
 async-std^1.81.13.2up to date
 async-trait^0.10.1.92up to date
 base64^0.220.23.1out of date
 boring^45.5.0out of date
 chumsky^0.90.13.0out of date
 ed25519-dalek^23.0.0out of date
 email-encoding^0.40.4.3up to date
 email_address^0.2.10.2.9up to date
 fastrand^2.02.5.0up to date
 futures-io^0.3.70.3.34up to date
 futures-rustls^0.260.26.0up to date
 futures-util^0.3.70.3.34up to date
 hostname^0.40.4.2up to date
 httpdate^11.0.3up to date
 idna^11.1.0up to date
 mime^0.3.40.3.18up to date
 native-tls^0.2.90.2.18up to date
 nom^88.0.0up to date
 percent-encoding^2.32.3.2up to date
 quoted_printable^0.50.5.2up to date
 rsa ⚠️^0.90.10.0insecure
 rustls^0.23.180.23.46up to date
 rustls-native-certs^0.80.8.5up to date
 serde^1.0.1101.0.229up to date
 serde_json^11.0.154up to date
 sha2^0.100.11.1out of date
 socket2^0.5.10.6.5out of date
 tokio-boring^45.5.0out of date
 tokio^11.54.1up to date
 tokio-native-tls^0.30.3.1up to date
 tokio-rustls^0.260.26.6up to date
 tracing^0.1.160.1.44up to date
 url^2.42.5.8up to date
 uuid^11.29.2up to date
 web-time^1.1.01.1.0up to date
 webpki-roots^0.261.0.12out of date

Dev dependencies

(10 total, 2 outdated)

CrateRequiredLatestStatus
 async-std^1.81.13.2up to date
 criterion^0.50.8.2out of date
 glob^0.30.3.4up to date
 maud^0.260.27.0out of date
 pretty_assertions^11.4.1up to date
 serde_json^11.0.154up to date
 tokio^11.54.1up to date
 tracing^0.1.160.1.44up to date
 tracing-subscriber^0.30.3.23up to date
 walkdir^22.5.0up to date

Security Vulnerabilities

rsa: Marvin Attack: potential key recovery through timing sidechannels

RUSTSEC-2023-0071

Impact

Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key.

Patches

The rsa v0.10 series includes a migration to crypto-bigint and constant-time mitigations recommended in draft-irtf-cfrg-rsa-guidance. Upgrading to this release should resolve all known constant-time issues.

References

This vulnerability was discovered as part of the "Marvin Attack", which revealed several implementations of RSA including OpenSSL had not properly mitigated timing sidechannel attacks.