This project might be open to known security vulnerabilities , which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom .
Crate atm0s-media-server Dependencies (13 total, 1 outdated, 1 possibly insecure)
Crate media-server-protocol Dependencies (4 total, 1 possibly insecure)
Crate Required Latest Status bincode ^1.31.3.3up to date serde ^1.01.0.214up to date quinn ^0.110.11.5up to date tokio ⚠️ ^11.41.1maybe insecure
Build dependencies (3 total, all up-to-date)
Crate Required Latest Status prost-build ^0.130.13.3up to date tera ^11.20.0up to date serde ^1.0.2001.0.214up to date
Crate media-server-utils Dependencies (6 total, all up-to-date)
Crate media-server-core No external dependencies! 🙌
Crate media-server-runner Dependencies (1 total, 1 outdated)
Crate transport-webrtc Dependencies (1 total, all up-to-date)
Crate Required Latest Status str0m ^0.60.6.2up to date
Crate transport-rtpengine Dependencies (2 total, all up-to-date)
Crate Required Latest Status sdp-rs ^0.20.2.1up to date rtp-rs ^0.60.6.0up to date
Crate media-server-secure Dependencies (2 total, all up-to-date)
Crate Required Latest Status jwt-simple ^0.120.12.10up to date serde ^1.01.0.214up to date
Crate media-server-gateway No external dependencies! 🙌
Crate audio-mixer No external dependencies! 🙌
Crate media-server-connector Dependencies (9 total, 1 outdated)
Dev dependencies (1 total, 1 possibly insecure)
Crate Required Latest Status tokio ⚠️ ^11.41.1maybe insecure
Crate media-server-record Dependencies (11 total, 1 possibly insecure)
Crate Required Latest Status tokio ⚠️ ^11.41.1maybe insecure reqwest ^0.120.12.9up to date tokio-util ^0.7.110.7.12up to date futures ^0.3.300.3.31up to date bytes ^1.6.01.8.0up to date surf ^2.3.22.3.2up to date webm ^1.1.21.1.2up to date rtp ^0.11.00.11.0up to date clap ^4.54.5.20up to date serde ^1.01.0.214up to date serde_json ^1.0.1201.0.132up to date
Dev dependencies (1 total, 1 possibly insecure)
Crate Required Latest Status tokio ⚠️ ^11.41.1maybe insecure
Crate media-server-codecs Dependencies (2 total, all up-to-date)
Crate media-server-multi-tenancy Dependencies (1 total, all up-to-date)
Crate Required Latest Status reqwest ^0.120.12.9up to date
Crate rtpengine-ngcontrol Dependencies (3 total, all up-to-date)
Security Vulnerabilities tokio: reject_remote_clients Configuration corruptionRUSTSEC-2023-0001
On Windows, configuring a named pipe server with pipe_mode will force ServerOptions ::reject_remote_clients as false.
This drops any intended explicit configuration for the reject_remote_clients that may have been set as true previously.
The default setting of reject_remote_clients is normally true meaning the default is also overridden as false.
Workarounds
Ensure that pipe_mode is set first after initializing a ServerOptions . For example:
let mut opts = ServerOptions::new();
opts.pipe_mode(PipeMode::Message);
opts.reject_remote_clients(true);
Patched
>=1.18.4, <1.19.0
>=1.20.3, <1.21.0
>=1.23.1
rustls: `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network inputRUSTSEC-2024-0336
If a close_notify alert is received during a handshake, complete_io
does not terminate.
Callers which do not call complete_io are not affected.
rustls-tokio and rustls-ffi do not call complete_io
and are not affected.
rustls::Stream and rustls::StreamOwned types use
complete_io and are affected.
Patched
>=0.23.5
>=0.22.4, <0.23.0
>=0.21.11, <0.22.0
