This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate rustls-platform-verifier

Dependencies

(15 total, 7 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 android_logger^0.130.15.0out of date
 base64^0.220.22.1up to date
 core-foundation^0.90.10.1out of date
 core-foundation-sys^0.80.8.7up to date
 jni^0.190.21.1out of date
 log^0.40.4.27up to date
 once_cell^1.91.21.3up to date
 rustls ⚠️^0.230.23.28maybe insecure
 rustls-native-certs^0.70.8.1out of date
 rustls-platform-verifier-android^0.1.00.1.1up to date
 security-framework^2.103.2.0out of date
 security-framework-sys^2.102.14.0up to date
 rustls-webpki^0.1020.103.3out of date
 webpki-roots^0.261.0.1out of date
 winapi^0.30.3.9up to date

Dev dependencies

(2 total, 1 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 rustls ⚠️^0.230.23.28maybe insecure
 webpki-roots^0.261.0.1out of date

Security Vulnerabilities

rustls: rustls network-reachable panic in `Acceptor::accept`

RUSTSEC-2024-0399

A bug introduced in rustls 0.23.13 leads to a panic if the received TLS ClientHello is fragmented. Only servers that use rustls::server::Acceptor::accept() are affected.

Servers that use tokio-rustls's LazyConfigAcceptor API are affected.

Servers that use tokio-rustls's TlsAcceptor API are not affected.

Servers that use rustls-ffi's rustls_acceptor_accept API are affected.