This project might be open to known security vulnerabilities , which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom .
Crate mcaptcha
Dependencies (34 total, 10 outdated, 2 possibly insecure)
Dev dependencies (2 total, 1 outdated)
Build dependencies (2 total, all up-to-date)
Crate Required Latest Status serde_json ^1
1.0.116
up to date sqlx ^0.7
0.7.4
up to date
Crate db-core
Dependencies (5 total, all up-to-date)
Dev dependencies (1 total, all up-to-date)
Crate Required Latest Status serde_json ^1
1.0.116
up to date
Crate db-sqlx-postgres
Dependencies (4 total, all up-to-date)
Crate Required Latest Status async-trait ^0.1.51
0.1.80
up to date futures ^0.3.15
0.3.30
up to date sqlx ^0.7
0.7.4
up to date uuid ^1.4.0
1.8.0
up to date
Dev dependencies (3 total, all up-to-date)
Crate Required Latest Status actix-rt ^2
2.9.0
up to date sqlx ^0.7
0.7.4
up to date url ^2.2.2
2.5.0
up to date
Crate db-sqlx-maria
Dependencies (4 total, all up-to-date)
Crate Required Latest Status async-trait ^0.1.51
0.1.80
up to date futures ^0.3.15
0.3.30
up to date sqlx ^0.7
0.7.4
up to date uuid ^1.4.0
1.8.0
up to date
Dev dependencies (3 total, all up-to-date)
Crate Required Latest Status actix-rt ^2
2.9.0
up to date sqlx ^0.7
0.7.4
up to date url ^2.2.2
2.5.0
up to date
Security Vulnerabilities tokio
: reject_remote_clients Configuration corruptionRUSTSEC-2023-0001
On Windows, configuring a named pipe server with pipe_mode will force ServerOptions ::reject_remote_clients as false
.
This drops any intended explicit configuration for the reject_remote_clients that may have been set as true
previously.
The default setting of reject_remote_clients is normally true
meaning the default is also overridden as false
.
Workarounds
Ensure that pipe_mode is set first after initializing a ServerOptions . For example:
let mut opts = ServerOptions::new();
opts.pipe_mode(PipeMode::Message);
opts.reject_remote_clients(true);
Patched
>=1.18.4, <1.19.0
>=1.20.3, <1.21.0
>=1.23.1
openssl
: `openssl` `X509VerifyParamRef::set_host` buffer over-readRUSTSEC-2023-0044
When this function was passed an empty string, openssl
would attempt to call strlen
on it, reading arbitrary memory until it reached a NUL byte.