Deps.rs

parquet 46.0.0

[![dependency status](https://deps.rs/crate/parquet/46.0.0/status.svg)](https://deps.rs/crate/parquet/46.0.0)

This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate parquet

Dependencies

(30 total, 16 outdated, 1 insecure)

CrateRequiredLatestStatus
 ahash^0.80.8.12up to date
 arrow-array^46.0.060.0.0out of date
 arrow-buffer^46.0.060.0.0out of date
 arrow-cast^46.0.060.0.0out of date
 arrow-csv^46.0.060.0.0out of date
 arrow-data^46.0.060.0.0out of date
 arrow-ipc^46.0.060.0.0out of date
 arrow-schema^46.0.060.0.0out of date
 arrow-select^46.0.060.0.0out of date
 base64^0.210.23.1out of date
 brotli^3.39.0.0out of date
 bytes^1.11.12.1up to date
 chrono^0.4.230.4.45up to date
 clap^4.14.6.7up to date
 flate2^1.01.1.10up to date
 futures^0.30.3.34up to date
 hashbrown^0.140.17.1out of date
 lz4^1.231.28.1up to date
 num^0.40.4.3up to date
 num-bigint^0.40.5.1out of date
 object_store ⚠️^0.70.14.2insecure
 paste^1.01.0.15up to date
 seq-macro^0.30.3.6up to date
 serde^1.01.0.229up to date
 serde_json^1.01.0.151up to date
 snap^1.01.1.2up to date
 thrift^0.170.24.0out of date
 tokio^1.01.53.1up to date
 twox-hash^1.62.1.4out of date
 zstd^0.12.00.14.0out of date

Dev dependencies

(12 total, 6 outdated)

CrateRequiredLatestStatus
 arrow^46.0.060.0.0out of date
 base64^0.210.23.1out of date
 brotli^3.39.0.0out of date
 criterion^0.50.8.2out of date
 flate2^1.01.1.10up to date
 lz4^1.231.28.1up to date
 rand^0.80.10.2out of date
 serde_json^1.01.0.151up to date
 snap^1.01.1.2up to date
 tempfile^3.03.27.0up to date
 tokio^1.01.53.1up to date
 zstd^0.120.14.0out of date

Security Vulnerabilities

object_store: Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files

RUSTSEC-2024-0358

Exposure of temporary credentials in logs in Apache Arrow Rust Object Store, version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens.

On certain error conditions, the logs may contain the OIDC token passed to AssumeRoleWithWebIdentity. This allows someone with access to the logs to impersonate that identity, including performing their own calls to AssumeRoleWithWebIdentity, until the OIDC token expires. Typically OIDC tokens are valid for up to an hour, although this will vary depending on the issuer.

Users are recommended to use a different AWS authentication mechanism, disable logging or upgrade to version 0.10.2, which fixes this issue.

Details

When using AWS WebIdentityTokens with the object_store crate, in the event of a failure and automatic retry, the underlying reqwest error, including the full URL with the credentials, potentially in the parameters, is written to the logs.

Thanks to Paul Hatcherian for reporting this vulnerability