This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate cargo-deny

Dependencies

(29 total, 3 outdated, 1 insecure, 1 possibly insecure)

CrateRequiredLatestStatus
 ansi_term^0.120.12.1up to date
 anyhow^1.01.0.44up to date
 askalono^0.40.4.3up to date
 atty^0.20.2.14up to date
 bitvec^0.220.22.3up to date
 cargo ⚠️^0.550.56.0insecure
 chrono^0.40.4.19up to date
 codespan^0.110.11.1up to date
 codespan-reporting^0.110.11.1up to date
 crossbeam^0.80.8.1up to date
 similar^1.32.1.0out of date
 fern^0.60.6.0up to date
 git2^0.130.13.23up to date
 home^0.50.5.3up to date
 krates^0.80.8.1up to date
 log^0.40.4.14up to date
 memchr^2.32.4.1up to date
 rayon^1.41.5.1up to date
 rustsec^0.240.24.3up to date
 semver^1.01.0.4up to date
 serde^1.01.0.130up to date
 serde_json^1.01.0.68up to date
 smallvec ⚠️^1.61.7.0maybe insecure
 spdx^0.60.6.1up to date
 structopt^0.30.3.25up to date
 toml^0.50.5.8up to date
 toml_edit^0.20.6.0out of date
 twox-hash^1.51.6.1up to date
 url^2.12.2.2up to date

Dev dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 lazy_static^1.4.01.4.0up to date
 tempfile^3.1.03.2.0up to date

Security Vulnerabilities

smallvec: Buffer overflow in SmallVec::insert_many

RUSTSEC-2021-0003

A bug in the SmallVec::insert_many method caused it to allocate a buffer that was smaller than needed. It then wrote past the end of the buffer, causing a buffer overflow and memory corruption on the heap.

This bug was only triggered if the iterator passed to insert_many yielded more items than the lower bound returned from its size_hint method.

The flaw was corrected in smallvec 0.6.14 and 1.6.1, by ensuring that additional space is always reserved for each item inserted. The fix also simplified the implementation of insert_many to use less unsafe code, so it is easier to verify its correctness.

Thank you to Yechan Bae (@Qwaz) and the Rust group at Georgia Tech’s SSLab for finding and reporting this bug.

cargo: Cargo prior to Rust 1.26.0 may download the wrong dependency

CVE-2019-16760

The Rust team was recently notified of a security concern when using older versions of Cargo to build crates which use the package rename feature added in newer versions of Cargo. If you're using Rust 1.26.0, released on 2018-05-10, or later you're not affected.

The CVE for this vulnerability is CVE-2019-16760.

Overview

Cargo can be configured through Cargo.toml and the [dependencies] section to depend on different crates, such as those from crates.io. There are multiple ways to configure how you depend on crates as well, for example if you depend on serde and enable the derive feature it would look like:

serde = { version = "1.0", features = ['derive'] }

Rust 1.31.0 introduced a new feature of Cargo where one of the optional keys you can specify in this map is package, a way to rename a crate locally. For example if you preferred to use serde1 locally instead of serde, you could write:

serde1 = { version = "1.0", features = ['derive'], package = "serde" }

It's the addition of the package key that causes Cargo to compile the crate differently. This feature was first implemented in Rust 1.26.0, but it was unstable at the time. For Rust 1.25.0 and prior, however, Cargo would ignore the package key and and interpret the dependency line as if it were:

serde1 = { version = "1.0", features = ['derive'] }

This means when compiled with Rust 1.25.0 and prior then it would attempt to download the serde1 crate. A malicious user could squat the serde1 name on crates.io to look like serde 1.0.0 but instead act maliciously when built.

In summary, usage of the package key to rename dependencies in Cargo.toml is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is used Cargo will ignore package and download the wrong dependency, which could be squatted on crates.io to be a malicious package. This not only affects manifests that you write locally yourself, but also manifests published to crates.io. If you published a crate, for example, that depends on serde1 to crates.io then users who depend on you may also be vulnerable if they use Rust 1.25.0 and prior.

Affected Versions

Rust 1.0.0 through Rust 1.25.0 is affected by this advisory because Cargo will ignore the package key in manifests. Rust 1.26.0 through Rust 1.30.0 are not affected and typically will emit an error because the package key is unstable. Rust 1.31.0 and after are not affected because Cargo understands the package key.

In terms of Cargo versions, this affects Cargo up through Cargo 0.26.0. All future versions of Cargo are unaffected.

Mitigations

We strongly recommend that users of the affected versions update their compiler to the latest available one. Preventing this issue from happening requires updating your compiler to either Rust 1.26.0 or newer.

We will not be issuing a patch release for Rust versions prior to 1.26.0. Users of Rust 1.19.0 to Rust 1.25.0 can instead apply the provided patches to mitigate the issue.

An audit of existing crates published to crates.io using the package key has been performed and there is no evidence that this vulnerability has been exploited in the wild. Our audit only covers the crates currently published on crates.io: if you notice crates exploiting this vulnerability in the future please don't hesitate to email [email protected] in accordance with our security policy.

Timeline of events

  • Wed, Sep 18, 2019 at 13:54 UTC - Bug reported to [email protected]
  • Wed, Sep 18, 2019 at 15:35 UTC - Response confirming the report
  • Wed, Sep 18, 2019 - Cargo, Core, and crates.io teams confer on how best to handle this
  • Thu, Sep 19, 2019 - Confirmed with Elichai plan of action and continued to audit existing crates
  • Mon, Sep 23, 2019 - Advisory drafted, patches developed, audit completed
  • Mon, Sep 30, 2019 - Advisory published, security list informed of this issue

Acknowledgments

Thanks to Elichai Turkel, who found this bug and reported it to us in accordance with our security policy.

Links