This project contains known security vulnerabilities. Find detailed information at the bottom.
tlfs(18 total, 8 outdated, 3 insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| anyhow | ^1.0.51 | 1.0.104 | up to date |
| async-trait | ^0.1.52 | 0.1.92 | up to date |
| bytecheck | ^0.6.7 | 0.8.3 | out of date |
| ed25519-dalek ⚠️ | ^1.0.1 | 3.0.0 | insecure |
| fnv | ^1.0.7 | 1.0.7 | up to date |
| futures | ^0.3.17 | 0.3.34 | up to date |
| libp2p-broadcast | ^0.7.0 | 0.12.0 | out of date |
| libp2p-webrtc | ^0.2.1 | N/A | up to date |
| log-panics | ^2.0.0 | 2.1.0 | up to date |
| rkyv ⚠️ | ^0.7.26 | 0.8.18 | insecure |
| tracing | ^0.1.29 | 0.1.44 | up to date |
| tracing-log | ^0.1.2 | 0.2.0 | out of date |
| tracing-subscriber | ^0.3.3 | 0.3.23 | up to date |
| libp2p ⚠️ | ^0.42.0 | 0.57.1 | insecure |
| tracing-wasm | ^0.2.1 | 0.2.1 | up to date |
| wasm-bindgen-futures | ^0.4.28 | 0.4.79 | up to date |
| async-global-executor | ^2.0.2 | 3.1.0 | out of date |
| tracing-android | ^0.1.6 | 0.2.0 | out of date |
(1 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| async-std | ^1.10.0 | 1.13.2 | up to date |
tlfs-crdt(19 total, 7 outdated, 2 insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| anyhow | ^1.0.51 | 1.0.104 | up to date |
| base64 | ^0.13.0 | 0.23.1 | out of date |
| blake3 | ^1.2.0 | 1.8.7 | up to date |
| bytecheck | ^0.6.7 | 0.8.3 | out of date |
| crepe | ^0.1.5 | 0.2.0 | out of date |
| ed25519-dalek ⚠️ | ^1.0.1 | 3.0.0 | insecure |
| futures | ^0.3.17 | 0.3.34 | up to date |
| getrandom | ^0.2.3 | 0.4.3 | out of date |
| hex | ^0.4.3 | 0.4.3 | up to date |
| parking_lot | ^0.11.2 | 0.13.0 | out of date |
| rkyv ⚠️ | ^0.7.26 | 0.8.18 | insecure |
| smallvec | ^1.7.0 | 1.16.4 | up to date |
| tracing | ^0.1.29 | 0.1.44 | up to date |
| vec-collections | ^0.4.3 | 0.4.3 | up to date |
| wasm-bindgen-futures | ^0.4.28 | 0.4.79 | up to date |
| js-sys | ^0.3.55 | 0.3.106 | up to date |
| web-sys | ^0.3.55 | 0.3.106 | up to date |
| wasm-bindgen | ^0.2.78 | 0.2.129 | up to date |
| url | ^2.2.2 | 2.5.8 | up to date |
(5 total, 1 outdated)
| Crate | Required | Latest | Status |
|---|---|---|---|
| async-std | ^1.10.0 | 1.13.2 | up to date |
| log-panics | ^2.0.0 | 2.1.0 | up to date |
| proptest | ^1.0.0 | 1.12.0 | up to date |
| tracing-log | ^0.1.2 | 0.2.0 | out of date |
| tracing-subscriber | ^0.3.3 | 0.3.23 | up to date |
tlfs-api(6 total, 1 outdated)
| Crate | Required | Latest | Status |
|---|---|---|---|
| anyhow | ^1.0.51 | 1.0.104 | up to date |
| ffi-gen | ^0.1.5 | 0.1.13 | up to date |
| ffi-gen-macro | ^0.1.2 | 0.1.2 | up to date |
| futures | ^0.3.17 | 0.3.34 | up to date |
| getrandom | ^0.2.3 | 0.4.3 | out of date |
| wasm-bindgen | ^0.2.78 | 0.2.129 | up to date |
(1 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| ffi-gen | ^0.1.5 | 0.1.13 | up to date |
relay(10 total, 5 outdated, 1 insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| acme-lib | ^0.8.2 | 0.9.1 | out of date |
| anyhow | ^1.0.51 | 1.0.104 | up to date |
| clap | ^3.0.0-rc.4 | 4.6.7 | out of date |
| hex | ^0.4.3 | 0.4.3 | up to date |
| libp2p ⚠️ | ^0.41.0 | 0.57.1 | insecure |
| rustls-pemfile | ^0.2.1 | 2.2.0 | out of date |
| tokio | ^1.14.0 | 1.54.1 | up to date |
| tracing | ^0.1.29 | 0.1.44 | up to date |
| tracing-subscriber | ^0.3.3 | 0.3.23 | up to date |
| warp | ^0.3.2 | 0.4.3 | out of date |
tlfsc(5 total, 1 outdated)
| Crate | Required | Latest | Status |
|---|---|---|---|
| anyhow | ^1.0.51 | 1.0.104 | up to date |
| clap | ^3.0.0-rc.4 | 4.6.7 | out of date |
| fnv | ^1.0.7 | 1.0.7 | up to date |
| pest | ^2.1.3 | 2.9.5 | up to date |
| pest_derive | ^2.1.0 | 2.9.5 | up to date |
libp2p: libp2p Lack of resource management DoSlibp2p allows a potential attacker to cause victim p2p node to run out of memory
The out of memory failure can cause crashes where libp2p is intended to be used within large scale networks leading to potential Denial of Service (DoS) vector
Users should upgrade or reference the DoS mitigation strategies.
ed25519-dalek: Double Public Key Signing Function Oracle Attack on `ed25519-dalek`Versions of ed25519-dalek prior to v2.0 model private and public keys as
separate types which can be assembled into a Keypair, and also provide APIs
for serializing and deserializing 64-byte private/public keypairs.
Such APIs and serializations are inherently unsafe as the public key is one of
the inputs used in the deterministic computation of the S part of the signature,
but not in the R value. An adversary could somehow use the signing function as
an oracle that allows arbitrary public keys as input can obtain two signatures
for the same message sharing the same R and only differ on the S part.
Unfortunately, when this happens, one can easily extract the private key.
Revised public APIs in v2.0 of ed25519-dalek do NOT allow a decoupled
private/public keypair as signing input, except as part of specially labeled
"hazmat" APIs which are clearly labeled as being dangerous if misused.
rkyv: Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/ArcShared pointer validation keyed already-validated pointees by their address and
type, but did not include pointer metadata. For unsized pointees, an archive
could therefore contain multiple Rc, Arc, or weak pointers that shared a
data address but used different metadata, such as different slice lengths.
Once the first pointer had been validated, later pointers to the same address
skipped pointee validation. The safe checked rkyv::access API could
consequently return a slice with a forged length, allowing safe indexing to
read out of bounds. The same validation bypass was reachable through checked
deserialization with rkyv::from_bytes.
Version 0.8.17 includes pointer metadata in shared pointer validation and rejects conflicting metadata. The 0.7 series is also affected but is no longer supported by upstream. Users who process untrusted archives should upgrade to 0.8.17 or later.