This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate webrtc

Dependencies

(36 total, 17 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 arc-swap^11.7.1up to date
 async-trait^0.10.1.83up to date
 bytes^11.7.2up to date
 cfg-if^11.0.0up to date
 webrtc-data^0.80.9.0out of date
 webrtc-dtls^0.80.10.0out of date
 hex^0.40.4.3up to date
 webrtc-ice^0.100.11.0out of date
 interceptor^0.100.12.0out of date
 lazy_static^1.41.5.0up to date
 log^0.40.4.22up to date
 webrtc-mdns^0.60.7.0out of date
 webrtc-media^0.70.8.0out of date
 pem^33.0.4up to date
 rand^0.80.8.5up to date
 rcgen^0.110.13.1out of date
 regex^1.9.51.11.0up to date
 ring^0.160.17.8out of date
 rtcp^0.100.11.0out of date
 rtp^0.90.11.0out of date
 rustls ⚠️^0.210.23.14out of date
 webrtc-sctp^0.90.10.0out of date
 sdp^0.60.6.2up to date
 serde^11.0.210up to date
 serde_json^11.0.128up to date
 sha2^0.100.10.8up to date
 smol_str^0.20.3.1out of date
 webrtc-srtp^0.110.13.0out of date
 stun^0.50.6.0out of date
 thiserror^11.0.64up to date
 time^0.30.3.36up to date
 tokio^1.32.01.40.0up to date
 turn^0.70.8.0out of date
 url^22.5.2up to date
 webrtc-util^0.80.9.0out of date
 waitgroup^0.10.1.2up to date

Dev dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 env_logger^0.100.11.5out of date
 tokio-test^0.40.4.4up to date

Security Vulnerabilities

rustls: `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input

RUSTSEC-2024-0336

If a close_notify alert is received during a handshake, complete_io does not terminate.

Callers which do not call complete_io are not affected.

rustls-tokio and rustls-ffi do not call complete_io and are not affected.

rustls::Stream and rustls::StreamOwned types use complete_io and are affected.