This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.
torchbear(29 total, 19 outdated, 5 possibly insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| actix | ^0.7 | 0.13.3 | out of date |
| actix-lua | ^0.5 | 0.7.0 | out of date |
| actix-web ⚠️ | ^0.7 | 4.5.1 | out of date |
| base64 | ^0.9 | 0.22.0 | out of date |
| chrono ⚠️ | ^0.4 | 0.4.38 | maybe insecure |
| clap | ^2.32 | 4.5.4 | out of date |
| colored | ^1.6.1 | 2.1.0 | out of date |
| comrak ⚠️ | ^0.2 | 0.22.0 | out of date |
| config | ^0.9 | 0.14.0 | out of date |
| env_logger | ^0.5 | 0.11.3 | out of date |
| failure | ^0.1 | 0.1.8 | up to date |
| failure_derive | ^0.1 | 0.1.8 | up to date |
| fern | ^0.5 | 0.6.2 | out of date |
| futures | ^0.1 | 0.3.30 | out of date |
| git2 | ^0.7 | 0.18.3 | out of date |
| log | ^0.4.5 | 0.4.21 | up to date |
| log-panics | ^2.0 | 2.1.0 | up to date |
| openssl ⚠️ | ^0.10 | 0.10.64 | maybe insecure |
| rlua | ^0.15 | 0.20.0 | out of date |
| rlua_serde | ^0.2 | 0.4.0 | out of date |
| rust_sodium | ^0.10 | 0.10.2 | up to date |
| select | ^0.4 | 0.6.0 | out of date |
| serde | ^1.0 | 1.0.198 | up to date |
| serde_derive | ^1.0 | 1.0.198 | up to date |
| serde_json | ^1.0 | 1.0.116 | up to date |
| serde_urlencoded | ^0.5 | 0.7.1 | out of date |
| serde_yaml ⚠️ | ^0.8 | 0.9.34+deprecated | out of date |
| tera | ^0.11 | 1.19.1 | out of date |
| uuid | ^0.6 | 1.8.0 | out of date |
(1 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| tempfile | ^3 | 3.10.1 | up to date |
serde_yaml: Uncontrolled recursion leads to abort in deserializationAffected versions of this crate did not properly check for recursion while deserializing aliases.
This allows an attacker to make a YAML file with an alias referring to itself causing an abort.
The flaw was corrected by checking the recursion depth.
actix-web: Multiple memory safety issuesAffected versions contain multiple memory safety issues, such as:
Send marker trait to objects that cannot be safely sent between threadsThis may result in a variety of memory corruption scenarios, most likely use-after-free.
A significant refactoring effort has been conducted to resolve these issues.
chrono: Potential segfault in `localtime_r` invocationsUnix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.
No workarounds are known.
comrak: XSS in `comrak`The comrak we were matching unsafe URL prefixes, such as data: or javascript: , in a case-sensitive manner. This meant prefixes like Data: were untouched.
comrak: XSS in `comrak`comrak operates by default in a "safe" mode of operation where unsafe content, such as arbitrary raw HTML or URLs with non-standard schemes, are not permitted in the output. This is per the reference GFM implementation, cmark-gfm.
Ampersands were not being correctly escaped in link targets, making it possible
to fashion unsafe URLs using schemes like data: or javascript: by entering
them as HTML entities, e.g. data:. The intended
behaviour, demonstrated upstream, is that these should be escaped and therefore
harmless, but this behaviour was broken in comrak.
openssl: `openssl` `X509VerifyParamRef::set_host` buffer over-readWhen this function was passed an empty string, openssl would attempt to call strlen on it, reading arbitrary memory until it reached a NUL byte.