Deps.rs

actix / actix-net

[![dependency status](https://deps.rs/repo/github/actix/actix-net/status.svg)](https://deps.rs/repo/github/actix/actix-net)

This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate actix-codec

Dependencies

(9 total, all up-to-date)

CrateRequiredLatestStatus
 bitflags^22.5.0up to date
 bytes^11.6.0up to date
 futures-core^0.3.70.3.30up to date
 futures-sink^0.3.70.3.30up to date
 memchr^2.32.7.2up to date
 pin-project-lite^0.20.2.14up to date
 tokio^1.23.11.37.0up to date
 tokio-util^0.70.7.10up to date
 tracing^0.1.300.1.40up to date

Dev dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 criterion^0.50.5.1up to date
 tokio-test^0.4.20.4.4up to date

Crate actix-macros

Dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 quote^11.0.36up to date
 syn^22.0.60up to date

Dev dependencies

(4 total, all up-to-date)

CrateRequiredLatestStatus
 actix-rt^22.9.0up to date
 futures-util^0.3.170.3.30up to date
 rustversion^11.0.15up to date
 trybuild^11.0.91up to date

Crate actix-rt

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 actix-macros^0.2.30.2.4up to date
 futures-core^0.30.3.30up to date
 tokio^1.23.11.37.0up to date

Dev dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 tokio^1.23.11.37.0up to date

Crate actix-server

Dependencies

(9 total, 1 possibly insecure)

CrateRequiredLatestStatus
 actix-rt^2.82.9.0up to date
 actix-service^22.0.2up to date
 actix-utils^33.0.1up to date
 futures-core^0.3.170.3.30up to date
 futures-util^0.3.170.3.30up to date
 mio ⚠️^0.80.8.11maybe insecure
 socket2^0.50.5.6up to date
 tokio^1.23.11.37.0up to date
 tracing^0.1.300.1.40up to date

Dev dependencies

(6 total, 1 outdated)

CrateRequiredLatestStatus
 actix-codec^0.50.5.2up to date
 actix-rt^2.82.9.0up to date
 bytes^11.6.0up to date
 env_logger^0.100.11.3out of date
 futures-util^0.3.170.3.30up to date
 tokio^1.23.11.37.0up to date

Crate actix-service

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 futures-core^0.3.170.3.30up to date
 paste^11.0.14up to date
 pin-project-lite^0.20.2.14up to date

Dev dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 actix-rt^22.9.0up to date
 actix-utils^33.0.1up to date
 futures-util^0.3.170.3.30up to date

Crate actix-tls

Dependencies

(19 total, 3 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 actix-rt^2.22.9.0up to date
 actix-service^22.0.2up to date
 actix-utils^33.0.1up to date
 futures-core^0.3.70.3.30up to date
 impl-more^0.10.1.6up to date
 pin-project-lite^0.2.70.2.14up to date
 tokio^1.23.11.37.0up to date
 tokio-util^0.70.7.10up to date
 tracing^0.1.300.1.40up to date
 http^11.1.0up to date
 openssl^0.10.550.10.64up to date
 tokio-openssl^0.60.6.4up to date
 tokio-rustls^0.250.26.0out of date
 webpki-roots^0.260.26.1up to date
 rustls ⚠️^0.21.60.23.5out of date
 rustls-webpki^0.101.40.102.3out of date
 rustls-pki-types^11.5.0up to date
 rustls-native-certs^0.70.7.0up to date
 tokio-native-tls^0.30.3.1up to date

Dev dependencies

(11 total, 3 outdated)

CrateRequiredLatestStatus
 actix-codec^0.50.5.2up to date
 actix-rt^2.22.9.0up to date
 actix-server^22.3.0up to date
 bytes^11.6.0up to date
 env_logger^0.100.11.3out of date
 futures-util^0.3.170.3.30up to date
 itertools^0.120.12.1up to date
 rcgen^0.120.13.1out of date
 rustls-pemfile^22.1.2up to date
 tokio-rustls^0.250.26.0out of date
 trust-dns-resolver^0.230.23.2up to date

Crate actix-tracing

Dependencies

(4 total, all up-to-date)

CrateRequiredLatestStatus
 actix-service^22.0.2up to date
 actix-utils^33.0.1up to date
 tracing^0.1.350.1.40up to date
 tracing-futures^0.20.2.5up to date

Crate actix-utils

Dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 pin-project-lite^0.20.2.14up to date
 local-waker^0.10.1.4up to date

Dev dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 actix-rt^22.9.0up to date
 futures-util^0.3.170.3.30up to date
 static_assertions^1.11.1.0up to date

Crate bytestring

Dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 bytes^1.21.6.0up to date
 serde^1.01.0.198up to date

Dev dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 ahash^0.80.8.11up to date
 serde_json^1.01.0.116up to date
 static_assertions^1.11.1.0up to date

Crate local-channel

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 futures-core^0.3.170.3.30up to date
 futures-sink^0.3.170.3.30up to date
 local-waker^0.10.1.4up to date

Dev dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 futures-util^0.3.170.3.30up to date
 tokio^1.23.11.37.0up to date

Crate local-waker

No external dependencies! 🙌

Security Vulnerabilities

mio: Tokens for named pipes may be delivered after deregistration

RUSTSEC-2024-0019

Impact

When using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free.

For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio.

The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected.

Affected versions

This vulnerability has been fixed in mio v0.8.11.

All versions of mio between v0.7.2 and v0.8.10 are vulnerable.

Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable.

Workarounds

Vulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens.

Technical details

When an IO resource registered with mio has a readiness event, mio delivers that readiness event to the user using a user-specified token. Mio guarantees that when an IO resource is deregistered, then it will never return the token for that IO resource again. However, for named pipes on windows, mio may sometimes deliver the token for a named pipe even though the named pipe has been previously deregistered.

This vulnerability was originally reported in the Tokio issue tracker: tokio-rs/tokio#6369
This vulnerability was fixed in: tokio-rs/mio#1760

Thank you to @rofoun and @radekvit for discovering and reporting this issue.

rustls: `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input

RUSTSEC-2024-0336

If a close_notify alert is received during a handshake, complete_io does not terminate.

Callers which do not call complete_io are not affected.

rustls-tokio and rustls-ffi do not call complete_io and are not affected.

rustls::Stream and rustls::StreamOwned types use complete_io and are affected.