SergioBenitez / Rocket

This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate `rocket`

Dependencies

(38 total, 1 possibly insecure)

Crate	Required	Latest	Status
serde_json	`^1.0.26`	`1.0.116`	up to date
rmp-serde	`^1`	`1.2.0`	up to date
uuid	`^1`	`1.8.0`	up to date
x509-parser	`^0.16`	`0.16.0`	up to date
http	`^1`	`1.1.0`	up to date
bytes	`^1.4`	`1.6.0`	up to date
hyper	`^1.1`	`1.3.1`	up to date
yansi	`^1.0.1`	`1.0.1`	up to date
log	`^0.4`	`0.4.21`	up to date
num_cpus	`^1.0`	`1.16.0`	up to date
time	`^0.3`	`0.3.36`	up to date
memchr	`^2`	`2.7.2`	up to date
binascii	`^0.1`	`0.1.4`	up to date
ref-cast	`^1.0`	`1.0.22`	up to date
ref-swap	`^0.1.2`	`0.1.2`	up to date
parking_lot	`^0.12`	`0.12.1`	up to date
ubyte	`^0.10.2`	`0.10.4`	up to date
serde	`^1.0`	`1.0.198`	up to date
figment	`^0.10.17`	`0.10.18`	up to date
rand	`^0.8`	`0.8.5`	up to date
either	`^1`	`1.11.0`	up to date
pin-project-lite	`^0.2`	`0.2.14`	up to date
indexmap	`^2`	`2.2.6`	up to date
tempfile	`^3`	`3.10.1`	up to date
async-trait	`^0.1.43`	`0.1.80`	up to date
async-stream	`^0.3.2`	`0.3.5`	up to date
multer	`^3.0.0`	`3.0.0`	up to date
tokio-stream	`^0.1.6`	`0.1.15`	up to date
cookie	`^0.18`	`0.18.1`	up to date
futures	`^0.3.30`	`0.3.30`	up to date
state	`^0.6`	`0.6.0`	up to date
hyper-util	`^0.1.3`	`0.1.3`	up to date
tokio	`^1.35.1`	`1.37.0`	up to date
tokio-util	`^0.7`	`0.7.10`	up to date
rustls ⚠️	`^0.23`	`0.23.5`	maybe insecure
tokio-rustls	`^0.26`	`0.26.0`	up to date
rustls-pemfile	`^2.1.0`	`2.1.2`	up to date
s2n-quic	`^1.36`	`1.37.0`	up to date

Dev dependencies

(3 total, 1 possibly insecure)

Crate	Required	Latest	Status
tokio ⚠️	`^1`	`1.37.0`	maybe insecure
figment	`^0.10.17`	`0.10.18`	up to date
pretty_assertions	`^1`	`1.4.0`	up to date

Build dependencies

(1 total, all up-to-date)

Crate	Required	Latest	Status
version_check	`^0.9.1`	`0.9.4`	up to date

Crate `rocket_codegen`

Dependencies

(8 total, all up-to-date)

Crate	Required	Latest	Status
indexmap	`^2`	`2.2.6`	up to date
quote	`^1.0`	`1.0.36`	up to date
syn	`^2.0`	`2.0.60`	up to date
proc-macro2	`^1.0.60`	`1.0.81`	up to date
devise	`^0.4`	`0.4.1`	up to date
unicode-xid	`^0.2`	`0.2.4`	up to date
version_check	`^0.9`	`0.9.4`	up to date
glob	`^0.3`	`0.3.1`	up to date

Dev dependencies

(4 total, all up-to-date)

Crate	Required	Latest	Status
time	`^0.3`	`0.3.36`	up to date
pretty_assertions	`^1`	`1.4.0`	up to date
version_check	`^0.9`	`0.9.4`	up to date
trybuild	`^1.0`	`1.0.91`	up to date

Crate `rocket_http`

Dependencies

(14 total, all up-to-date)

Crate	Required	Latest	Status
tinyvec	`^1.6`	`1.6.0`	up to date
percent-encoding	`^2`	`2.3.1`	up to date
time	`^0.3`	`0.3.36`	up to date
indexmap	`^2`	`2.2.6`	up to date
ref-cast	`^1.0`	`1.0.22`	up to date
uncased	`^0.9.10`	`0.9.10`	up to date
either	`^1`	`1.11.0`	up to date
pear	`^0.2.9`	`0.2.9`	up to date
memchr	`^2`	`2.7.2`	up to date
stable-pattern	`^0.1`	`0.1.0`	up to date
cookie	`^0.18`	`0.18.1`	up to date
state	`^0.6`	`0.6.0`	up to date
serde	`^1.0`	`1.0.198`	up to date
uuid	`^1`	`1.8.0`	up to date

Crate `rocket_db_pools_codegen`

Dependencies

(2 total, all up-to-date)

Crate	Required	Latest	Status
devise	`^0.4`	`0.4.1`	up to date
quote	`^1`	`1.0.36`	up to date

Dev dependencies

(2 total, all up-to-date)

Crate	Required	Latest	Status
trybuild	`^1.0`	`1.0.91`	up to date
version_check	`^0.9`	`0.9.4`	up to date

Crate `rocket_db_pools`

Dependencies

(7 total, 3 outdated)

Crate	Required	Latest	Status
deadpool	`^0.10`	`0.11.2`	out of date
deadpool-postgres	`^0.12`	`0.13.0`	out of date
deadpool-redis	`^0.14`	`0.15.0`	out of date
mongodb	`^2`	`2.8.2`	up to date
diesel-async	`^0.4.1`	`0.4.1`	up to date
diesel	`^2.1`	`2.1.6`	up to date
sqlx	`^0.7`	`0.7.4`	up to date

Build dependencies

(1 total, all up-to-date)

Crate	Required	Latest	Status
version_check	`^0.9`	`0.9.4`	up to date

Crate `rocket_sync_db_pools_codegen`

Dependencies

(2 total, all up-to-date)

Crate	Required	Latest	Status
quote	`^1.0`	`1.0.36`	up to date
devise	`^0.4`	`0.4.1`	up to date

Dev dependencies

(2 total, all up-to-date)

Crate	Required	Latest	Status
version_check	`^0.9`	`0.9.4`	up to date
trybuild	`^1.0`	`1.0.91`	up to date

Crate `rocket_sync_db_pools`

Dependencies

(10 total, 3 outdated, 1 possibly insecure)

Crate	Required	Latest	Status
r2d2	`^0.8`	`0.8.10`	up to date
tokio ⚠️	`^1.6.1`	`1.37.0`	maybe insecure
serde	`^1.0`	`1.0.198`	up to date
diesel	`^2.0.0`	`2.1.6`	up to date
postgres	`^0.19`	`0.19.7`	up to date
r2d2_postgres	`^0.18`	`0.18.1`	up to date
rusqlite	`^0.29.0`	`0.31.0`	out of date
r2d2_sqlite	`^0.22.0`	`0.24.0`	out of date
memcache	`^0.15.2`	`0.17.2`	out of date
r2d2-memcache	`^0.6`	`0.6.0`	up to date

Build dependencies

(1 total, all up-to-date)

Crate	Required	Latest	Status
version_check	`^0.9.1`	`0.9.4`	up to date

Crate `rocket_dyn_templates`

Dependencies

(6 total, all up-to-date)

Crate	Required	Latest	Status
walkdir	`^2.4`	`2.5.0`	up to date
notify	`^6`	`6.1.1`	up to date
normpath	`^1`	`1.2.0`	up to date
tera	`^1.19.0`	`1.19.1`	up to date
handlebars	`^5.1`	`5.1.2`	up to date
minijinja	`^1.0.16`	`1.0.20`	up to date

Dev dependencies

(1 total, all up-to-date)

Crate	Required	Latest	Status
pretty_assertions	`^1.4`	`1.4.0`	up to date

Crate `rocket_ws`

Dependencies

(1 total, all up-to-date)

Crate	Required	Latest	Status
tokio-tungstenite	`^0.21`	`0.21.0`	up to date

Crate `rocket_docs_tests`

Dev dependencies

(3 total, 1 possibly insecure)

Crate	Required	Latest	Status
figment	`^0.10.17`	`0.10.18`	up to date
tokio ⚠️	`^1`	`1.37.0`	maybe insecure
rand	`^0.8`	`0.8.5`	up to date

Security Vulnerabilities

`tokio`: reject_remote_clients Configuration corruption

RUSTSEC-2023-0001

On Windows, configuring a named pipe server with pipe_mode will force ServerOptions::reject_remote_clients as false.

This drops any intended explicit configuration for the reject_remote_clients that may have been set as true previously.

The default setting of reject_remote_clients is normally true meaning the default is also overridden as false.

Workarounds

Ensure that pipe_mode is set first after initializing a ServerOptions. For example:

let mut opts = ServerOptions::new();
opts.pipe_mode(PipeMode::Message);
opts.reject_remote_clients(true);

`rustls`: `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input

RUSTSEC-2024-0336

If a close_notify alert is received during a handshake, complete_io does not terminate.

Callers which do not call complete_io are not affected.

rustls-tokio and rustls-ffi do not call complete_io and are not affected.

rustls::Stream and rustls::StreamOwned types use complete_io and are affected.

SergioBenitez / Rocket

Crate rocket

Dependencies

Dev dependencies

Build dependencies

Crate rocket_codegen

Dependencies

Dev dependencies

Crate rocket_http

Dependencies

Crate rocket_db_pools_codegen

Dependencies

Dev dependencies

Crate rocket_db_pools

Dependencies

Build dependencies

Crate rocket_sync_db_pools_codegen

Dependencies

Dev dependencies

Crate rocket_sync_db_pools

Dependencies

Build dependencies

Crate rocket_dyn_templates

Dependencies

Dev dependencies

Crate rocket_ws

Dependencies

Crate rocket_docs_tests

Dev dependencies

Security Vulnerabilities

tokio: reject_remote_clients Configuration corruption

Workarounds

rustls: `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input

Crate `rocket`

Crate `rocket_codegen`

Crate `rocket_http`

Crate `rocket_db_pools_codegen`

Crate `rocket_db_pools`

Crate `rocket_sync_db_pools_codegen`

Crate `rocket_sync_db_pools`

Crate `rocket_dyn_templates`

Crate `rocket_ws`

Crate `rocket_docs_tests`

`tokio`: reject_remote_clients Configuration corruption

`rustls`: `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input