This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate buildkite-jobify


(26 total, 6 outdated, 3 possibly insecure)

 anyhow^ to date
 app_dirs2^ to date
 base64^ of date
 bytes^ to date
 camino^ to date
 clap^ of date
 crossbeam^ to date
 flate2^ to date
 futures^ to date
 graphql_client^ of date
 http^ to date
 lru_time_cache^ to date
 openssl ⚠️^ insecure
 reqwest^ to date
 serde^ to date
 serde_json^ to date
 serde_yaml^ to date
 tar ⚠️^ insecure
 toml^ of date
 tame-oauth^ of date
 tracing^ to date
 tracing-subscriber^ to date
 twox-hash^ to date
 uuid^ to date
 tokio ⚠️^ insecure
 k8s-openapi^ of date

Security Vulnerabilities

tar: Links in archive can create arbitrary directories


When unpacking a tarball that contains a symlink the tar crate may create directories outside of the directory it's supposed to unpack into.

The function errors when it's trying to create a file, but the folders are already created at this point.

use std::{io, io::Result};
use tar::{Archive, Builder, EntryType, Header};

fn main() -> Result<()> {
    let mut buf = Vec::new();

        let mut builder = Builder::new(&mut buf);

        // symlink: parent -> ..
        let mut header = Header::new_gnu();
        builder.append(&header, io::empty())?;

        // file: symlink/exploit/foo/bar
        let mut header = Header::new_gnu();
        builder.append(&header, io::empty())?;



This has been fixed in and is published as tar 0.4.36. Thanks to Martin Michaelis (@mgjm) for discovering and reporting this, and Nikhil Benesch (@benesch) for the fix!

tokio: reject_remote_clients Configuration corruption


On Windows, configuring a named pipe server with pipe_mode will force ServerOptions::reject_remote_clients as false.

This drops any intended explicit configuration for the reject_remote_clients that may have been set as true previously.

The default setting of reject_remote_clients is normally true meaning the default is also overridden as false.


Ensure that pipe_mode is set first after initializing a ServerOptions. For example:

let mut opts = ServerOptions::new();

openssl: `openssl` `X509NameBuilder::build` returned object is not thread safe


OpenSSL has a modified bit that it can set on on X509_NAME objects. If this bit is set then the object is not thread-safe even when it appears the code is not modifying the value.

Thanks to David Benjamin (Google) for reporting this issue.

openssl: `openssl` `SubjectAlternativeName` and `ExtendedKeyUsage::other` allow arbitrary file read


SubjectAlternativeName and ExtendedKeyUsage arguments were parsed using the OpenSSL function X509V3_EXT_nconf. This function parses all input using an OpenSSL mini-language which can perform arbitrary file reads.

Thanks to David Benjamin (Google) for reporting this issue.

openssl: `openssl` `X509Extension::new` and `X509Extension::new_nid` null pointer dereference


These functions would crash when the context argument was None with certain extension types.

Thanks to David Benjamin (Google) for reporting this issue.