This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate ark-crypto-primitives

Dependencies

(15 total, 1 possibly insecure)

CrateRequiredLatestStatus
 ark-ff^0.5.00.5.0up to date
 ark-ec^0.5.00.5.0up to date
 ark-std^0.5.00.5.0up to date
 ark-serialize^0.5.00.5.0up to date
 blake2^0.100.10.6up to date
 sha2^0.100.10.9up to date
 digest^0.100.10.7up to date
 merlin^3.0.03.0.0up to date
 num-bigint^0.4.40.4.6up to date
 rayon^1.01.10.0up to date
 derivative^2.02.2.0up to date
 tracing^0.10.1.41up to date
 hashbrown ⚠️^0.150.15.4maybe insecure
 ahash^0.80.8.12up to date
 fnv^1.01.0.7up to date

Dev dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 criterion^0.60.6.0up to date

Crate ark-crypto-primitives-macros

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 quote^1.01.0.40up to date
 syn^2.02.0.104up to date
 proc-macro2^1.01.0.95up to date

Security Vulnerabilities

hashbrown: Borsh serialization of HashMap is non-canonical

RUSTSEC-2024-0402

The borsh serialization of the HashMap did not follow the borsh specification. It potentially produced non-canonical encodings dependent on insertion order. It also did not perform canonicty checks on decoding.

This can result in consensus splits and cause equivalent objects to be considered distinct.

This was patched in 0.15.1.