Deps.rs

solana-sdk 1.18.11

[![dependency status](https://deps.rs/crate/solana-sdk/1.18.11/status.svg)](https://deps.rs/crate/solana-sdk/1.18.11)

This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate solana-sdk

Dependencies

(46 total, 18 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 assert_matches^1.5.01.5.0up to date
 base64^0.21.70.22.1out of date
 bincode^1.3.31.3.3up to date
 bitflags^2.4.22.5.0up to date
 borsh^1.2.11.5.0up to date
 bs58^0.4.00.5.1out of date
 bytemuck^1.14.01.15.0up to date
 byteorder^1.5.01.5.0up to date
 chrono^0.4.310.4.38up to date
 curve25519-dalek^3.2.14.1.2out of date
 derivation-path^0.2.00.2.0up to date
 digest^0.10.70.10.7up to date
 ed25519-dalek ⚠️=1.0.12.1.1out of date
 ed25519-dalek-bip32^0.2.00.3.0out of date
 generic-array^0.14.71.0.0out of date
 hmac^0.12.10.12.1up to date
 itertools^0.10.50.12.1out of date
 js-sys^0.3.670.3.69up to date
 lazy_static^1.4.01.4.0up to date
 libsecp256k1^0.6.00.7.1out of date
 log^0.4.200.4.21up to date
 memmap2^0.5.100.9.4out of date
 num-derive^0.40.4.2up to date
 num-traits^0.20.2.18up to date
 num_enum^0.7.20.7.2up to date
 pbkdf2^0.11.00.12.2out of date
 qstring^0.7.20.7.2up to date
 qualifier_attr^0.2.20.2.2up to date
 rand^0.70.8.5out of date
 rustversion^1.0.141.0.15up to date
 serde^1.0.1951.0.200up to date
 serde_bytes^0.11.140.11.14up to date
 serde_derive^1.0.1031.0.200up to date
 serde_json^1.0.1111.0.116up to date
 serde_with^2.3.33.8.1out of date
 sha2^0.10.80.10.8up to date
 sha3^0.10.40.10.8up to date
 siphasher^0.3.111.0.1out of date
 solana-frozen-abi=1.18.111.18.12out of date
 solana-frozen-abi-macro=1.18.111.18.12out of date
 solana-logger=1.18.111.18.12out of date
 solana-program=1.18.111.18.12out of date
 solana-sdk-macro=1.18.111.18.12out of date
 thiserror^1.0.561.0.59up to date
 uriparse^0.6.40.6.4up to date
 wasm-bindgen^0.20.2.92up to date

Dev dependencies

(5 total, 2 outdated)

CrateRequiredLatestStatus
 anyhow^1.0.791.0.82up to date
 curve25519-dalek^3.2.14.1.2out of date
 hex^0.4.30.4.3up to date
 static_assertions^1.1.01.1.0up to date
 tiny-bip39^0.8.21.0.0out of date

Security Vulnerabilities

ed25519-dalek: Double Public Key Signing Function Oracle Attack on `ed25519-dalek`

RUSTSEC-2022-0093

Versions of ed25519-dalek prior to v2.0 model private and public keys as separate types which can be assembled into a Keypair, and also provide APIs for serializing and deserializing 64-byte private/public keypairs.

Such APIs and serializations are inherently unsafe as the public key is one of the inputs used in the deterministic computation of the S part of the signature, but not in the R value. An adversary could somehow use the signing function as an oracle that allows arbitrary public keys as input can obtain two signatures for the same message sharing the same R and only differ on the S part.

Unfortunately, when this happens, one can easily extract the private key.

Revised public APIs in v2.0 of ed25519-dalek do NOT allow a decoupled private/public keypair as signing input, except as part of specially labeled "hazmat" APIs which are clearly labeled as being dangerous if misused.