Deps.rs

mozilla / application-services

[![dependency status](https://deps.rs/repo/github/mozilla/application-services/status.svg)](https://deps.rs/repo/github/mozilla/application-services)

This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate as-ohttp-client

Dependencies

(5 total, 3 outdated)

CrateRequiredLatestStatus
 uniffi^0.28.20.28.3up to date
 thiserror^1.02.0.7out of date
 bhttp^0.30.5.3out of date
 parking_lot^0.120.12.3up to date
 rusqlite^0.31.00.32.1out of date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 uniffi^0.28.20.28.3up to date

Crate autofill

Dependencies

(10 total, 2 outdated)

CrateRequiredLatestStatus
 anyhow^1.01.0.94up to date
 lazy_static^1.41.5.0up to date
 log^0.40.4.22up to date
 rusqlite^0.31.00.32.1out of date
 serde^11.0.216up to date
 serde_derive^11.0.216up to date
 serde_json^11.0.133up to date
 thiserror^1.02.0.7out of date
 uniffi^0.28.20.28.3up to date
 url^2.22.5.4up to date

Dev dependencies

(2 total, 2 outdated)

CrateRequiredLatestStatus
 env_logger^0.100.11.5out of date
 libsqlite3-sys^0.28.00.30.1out of date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 uniffi^0.28.20.28.3up to date

Crate crashtest

Dependencies

(3 total, 1 outdated)

CrateRequiredLatestStatus
 log^0.40.4.22up to date
 thiserror^1.02.0.7out of date
 uniffi^0.28.20.28.3up to date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 uniffi^0.28.20.28.3up to date

Crate fxa-client

Dependencies

(12 total, 2 outdated)

CrateRequiredLatestStatus
 base64^0.210.22.1out of date
 hex^0.40.4.3up to date
 lazy_static^1.41.5.0up to date
 log^0.40.4.22up to date
 parking_lot>=0.11, <=0.120.12.3up to date
 serde^11.0.216up to date
 serde_derive^11.0.216up to date
 serde_json^11.0.133up to date
 url^2.22.5.4up to date
 thiserror^1.02.0.7out of date
 anyhow^1.01.0.94up to date
 uniffi^0.28.20.28.3up to date

Dev dependencies

(2 total, 2 outdated)

CrateRequiredLatestStatus
 mockall^0.110.13.1out of date
 mockito^0.311.6.1out of date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 uniffi^0.28.20.28.3up to date

Crate logins

Dependencies

(11 total, 2 outdated)

CrateRequiredLatestStatus
 serde^11.0.216up to date
 serde_derive^11.0.216up to date
 serde_json^11.0.133up to date
 parking_lot>=0.11, <=0.120.12.3up to date
 log^0.40.4.22up to date
 lazy_static^1.41.5.0up to date
 url^2.22.5.4up to date
 rusqlite^0.31.00.32.1out of date
 thiserror^1.02.0.7out of date
 anyhow^1.01.0.94up to date
 uniffi^0.28.20.28.3up to date

Dev dependencies

(3 total, 2 outdated)

CrateRequiredLatestStatus
 more-asserts^0.20.3.1out of date
 tempfile^3.2.03.14.0up to date
 env_logger^0.100.11.5out of date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 uniffi^0.28.20.28.3up to date

Crate nimbus-sdk

Dependencies

(18 total, 1 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 anyhow^11.0.94up to date
 serde^11.0.216up to date
 serde_derive^11.0.216up to date
 serde_json^11.0.133up to date
 log^0.40.4.22up to date
 thiserror^12.0.7out of date
 url^2.52.5.4up to date
 rkv^0.190.19.0up to date
 jexl-eval^0.3.00.3.0up to date
 uuid^1.31.11.0up to date
 sha2^0.100.10.8up to date
 hex^0.40.4.3up to date
 once_cell^11.20.2up to date
 uniffi^0.28.20.28.3up to date
 chrono ⚠️^0.40.4.39maybe insecure
 unicode-segmentation^1.8.01.12.0up to date
 cfg-if^1.0.01.0.0up to date
 regex^1.91.11.1up to date

Dev dependencies

(4 total, 2 outdated)

CrateRequiredLatestStatus
 env_logger^0.100.11.5out of date
 clap^2.344.5.23out of date
 tempfile^33.14.0up to date
 ctor^0.2.20.2.9up to date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 uniffi^0.28.20.28.3up to date

Crate places

Dependencies

(17 total, 3 outdated)

CrateRequiredLatestStatus
 serde^11.0.216up to date
 serde_derive^11.0.216up to date
 serde_json^11.0.133up to date
 parking_lot^0.120.12.3up to date
 log^0.40.4.22up to date
 lazy_static^1.41.5.0up to date
 url^2.12.5.4up to date
 percent-encoding^2.12.3.1up to date
 caseless^0.20.2.1up to date
 rusqlite^0.31.00.32.1out of date
 bitflags^1.22.6.0out of date
 idna^1.0.31.0.3up to date
 memchr^2.32.7.4up to date
 dogear^0.50.5.0up to date
 thiserror^1.02.0.7out of date
 anyhow^1.01.0.94up to date
 uniffi^0.28.20.28.3up to date

Dev dependencies

(3 total, 2 outdated)

CrateRequiredLatestStatus
 pretty_assertions^0.61.4.1out of date
 tempfile^3.13.14.0up to date
 env_logger^0.100.11.5out of date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 uniffi^0.28.20.28.3up to date

Crate push

Dependencies

(10 total, 3 outdated)

CrateRequiredLatestStatus
 serde^11.0.216up to date
 serde_json^11.0.133up to date
 bincode^1.21.3.3up to date
 lazy_static^1.41.5.0up to date
 base64^0.210.22.1out of date
 log^0.40.4.22up to date
 rusqlite^0.31.00.32.1out of date
 url^2.22.5.4up to date
 thiserror^1.02.0.7out of date
 uniffi^0.28.20.28.3up to date

Dev dependencies

(5 total, 3 outdated)

CrateRequiredLatestStatus
 env_logger^0.100.11.5out of date
 mockito^0.311.6.1out of date
 hex^0.40.4.3up to date
 tempfile^3.1.03.14.0up to date
 mockall^0.110.13.1out of date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 uniffi^0.28.20.28.3up to date

Crate relevancy

Dependencies

(14 total, 3 outdated)

CrateRequiredLatestStatus
 anyhow^1.01.0.94up to date
 log^0.40.4.22up to date
 md-5^0.100.10.6up to date
 parking_lot>=0.11, <=0.120.12.3up to date
 rand^0.80.8.5up to date
 rand_distr^0.40.4.3up to date
 rusqlite^0.31.00.32.1out of date
 serde^11.0.216up to date
 serde_json^11.0.133up to date
 serde_path_to_error^0.10.1.16up to date
 thiserror^1.02.0.7out of date
 uniffi^0.28.20.28.3up to date
 url^2.52.5.4up to date
 base64^0.21.20.22.1out of date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 uniffi^0.28.20.28.3up to date

Crate remote_settings

Dependencies

(13 total, 2 outdated)

CrateRequiredLatestStatus
 log^0.40.4.22up to date
 uniffi^0.28.20.28.3up to date
 thiserror^1.02.0.7out of date
 serde^11.0.216up to date
 serde_json^11.0.133up to date
 parking_lot^0.120.12.3up to date
 url^22.5.4up to date
 camino^1.01.1.9up to date
 rusqlite^0.31.00.32.1out of date
 jexl-eval^0.3.00.3.0up to date
 regex^1.91.11.1up to date
 anyhow^1.01.0.94up to date
 sha2^0.100.10.8up to date

Dev dependencies

(4 total, 2 outdated)

CrateRequiredLatestStatus
 expect-test^1.41.5.0up to date
 mockall^0.110.13.1out of date
 mockito^0.311.6.1out of date
 serde_json^11.0.133up to date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 uniffi^0.28.20.28.3up to date

Crate search

Dependencies

(5 total, 1 outdated)

CrateRequiredLatestStatus
 parking_lot>=0.11, <=0.120.12.3up to date
 serde^11.0.216up to date
 serde_json^11.0.133up to date
 thiserror^12.0.7out of date
 uniffi^0.28.20.28.3up to date

Dev dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 once_cell^1.18.01.20.2up to date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 uniffi^0.28.20.28.3up to date

Crate suggest

Dependencies

(14 total, 2 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 anyhow^1.01.0.94up to date
 rmp-serde^1.31.3.0up to date
 chrono ⚠️^0.40.4.39maybe insecure
 extend^1.11.2.0up to date
 log^0.40.4.22up to date
 once_cell^1.51.20.2up to date
 parking_lot>=0.11, <=0.120.12.3up to date
 rusqlite^0.31.00.32.1out of date
 serde^11.0.216up to date
 serde_json^11.0.133up to date
 tempfile^3.2.03.14.0up to date
 thiserror^12.0.7out of date
 uniffi^0.28.20.28.3up to date
 url^2.12.5.4up to date

Dev dependencies

(4 total, 1 outdated)

CrateRequiredLatestStatus
 criterion^0.50.5.1up to date
 env_logger^0.100.11.5out of date
 expect-test^1.41.5.0up to date
 hex^0.40.4.3up to date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 uniffi^0.28.20.28.3up to date

Crate error-support

Dependencies

(5 total, all up-to-date)

CrateRequiredLatestStatus
 log^0.40.4.22up to date
 lazy_static^1.41.5.0up to date
 parking_lot>=0.11, <=0.120.12.3up to date
 uniffi^0.28.20.28.3up to date
 backtrace^0.30.3.74up to date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 uniffi^0.28.20.28.3up to date

Crate error-support-tests

Dev dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 thiserror^12.0.7out of date
 trybuild^1.0.491.0.101up to date

Crate find-places-db

Dependencies

(3 total, 1 outdated)

CrateRequiredLatestStatus
 dirs^45.0.1out of date
 anyhow^1.01.0.94up to date
 log^0.40.4.22up to date

Crate sync-guid

Dependencies

(4 total, 2 outdated)

CrateRequiredLatestStatus
 rusqlite^0.31.00.32.1out of date
 serde^11.0.216up to date
 rand^0.80.8.5up to date
 base64^0.210.22.1out of date

Dev dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 serde_test^11.0.177up to date

Crate interrupt-support

Dependencies

(4 total, 1 outdated)

CrateRequiredLatestStatus
 lazy_static^1.41.5.0up to date
 parking_lot>=0.11, <=0.120.12.3up to date
 rusqlite^0.31.00.32.1out of date
 uniffi^0.28.20.28.3up to date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 uniffi^0.28.20.28.3up to date

Crate jwcrypto

Dependencies

(6 total, 2 outdated)

CrateRequiredLatestStatus
 base64^0.210.22.1out of date
 log^0.40.4.22up to date
 serde^11.0.216up to date
 serde_derive^11.0.216up to date
 serde_json^11.0.133up to date
 thiserror^1.02.0.7out of date

Crate nimbus-cli

Dependencies

(23 total, 10 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 clap^4.2.24.5.23up to date
 anyhow^1.0.441.0.94up to date
 serde_json^11.0.133up to date
 serde^1.01.0.216up to date
 thiserror^1.0.292.0.7out of date
 unicode-segmentation^1.8.01.12.0up to date
 console^0.15.50.15.8up to date
 glob^0.3.10.3.1up to date
 heck^0.4.10.5.0out of date
 whoami ⚠️^1.4.01.5.2maybe insecure
 update-informer^1.0.01.1.0up to date
 reqwest^0.11.180.12.9out of date
 serde_yaml^0.9.210.9.34+deprecatedup to date
 percent-encoding^2.3.02.3.1up to date
 copypasta^0.8.20.10.1out of date
 chrono^0.4.260.4.39up to date
 axum^0.6.180.7.9out of date
 tokio^1.29.11.42.0up to date
 tower^0.4.130.5.2out of date
 tower-http^0.4.10.6.2out of date
 tower-livereload^0.8.00.9.5out of date
 hyper^0.14.271.5.1out of date
 local-ip-address^0.5.40.6.3out of date

Crate nimbus-fml

Dependencies

(20 total, 6 outdated)

CrateRequiredLatestStatus
 clap^2.34.04.5.23out of date
 anyhow^1.0.441.0.94up to date
 serde_json^11.0.133up to date
 serde_yaml^0.8.210.9.34+deprecatedout of date
 serde^1.01.0.216up to date
 thiserror^1.0.292.0.7out of date
 askama^0.120.12.1up to date
 textwrap^0.14.20.16.1out of date
 heck^0.3.30.5.0out of date
 unicode-segmentation^1.8.01.12.0up to date
 url^22.5.4up to date
 reqwest^0.110.12.9out of date
 glob^0.3.00.3.1up to date
 uniffi^0.28.20.28.3up to date
 cfg-if^1.0.01.0.0up to date
 console^0.15.50.15.8up to date
 lazy_static^1.41.5.0up to date
 email_address^0.2.40.2.9up to date
 sha2^0.100.10.8up to date
 itertools^00.13.0up to date

Dev dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 tempfile^33.14.0up to date
 jsonschema^0.170.26.1out of date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 uniffi^0.28.20.28.3up to date

Crate payload-support

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 serde^11.0.216up to date
 serde_derive^11.0.216up to date
 serde_json^11.0.133up to date

Crate rand_rccrypto

Dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 rand^0.80.8.5up to date
 rand_core^0.60.6.4up to date

Crate rate-limiter

No external dependencies! 🙌

Crate restmail-client

Dependencies

(4 total, 1 outdated)

CrateRequiredLatestStatus
 thiserror^1.02.0.7out of date
 log^0.40.4.22up to date
 serde_json^11.0.133up to date
 url^2.22.5.4up to date

Crate rc_crypto

Dependencies

(5 total, 2 outdated)

CrateRequiredLatestStatus
 base64^0.210.22.1out of date
 hex^0.40.4.3up to date
 thiserror^1.02.0.7out of date
 hawk^55.0.1up to date
 ece^2.32.3.1up to date

Dev dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 ece^2.02.3.1up to date

Crate nss

Dependencies

(4 total, 2 outdated)

CrateRequiredLatestStatus
 base64^0.210.22.1out of date
 thiserror^1.02.0.7out of date
 serde^11.0.216up to date
 serde_derive^11.0.216up to date

Crate nss_build_common

No external dependencies! 🙌

Crate nss_sys

Dependencies

(1 total, 1 outdated)

CrateRequiredLatestStatus
 libsqlite3-sys^0.28.00.30.1out of date

Crate systest

Dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 libc^0.20.2.168up to date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 ctest2^0.40.4.9up to date

Crate rust-log-forwarder

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 log^0.40.4.22up to date
 parking_lot>=0.11, <=0.120.12.3up to date
 uniffi^0.28.20.28.3up to date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 uniffi^0.28.20.28.3up to date

Crate sql-support

Dependencies

(6 total, 2 outdated)

CrateRequiredLatestStatus
 log^0.40.4.22up to date
 lazy_static^1.41.5.0up to date
 thiserror^1.02.0.7out of date
 tempfile^3.1.03.14.0up to date
 parking_lot>=0.11, <=0.120.12.3up to date
 rusqlite^0.31.00.32.1out of date

Dev dependencies

(1 total, 1 outdated)

CrateRequiredLatestStatus
 env_logger^0.100.11.5out of date

Crate types

Dependencies

(4 total, 1 outdated)

CrateRequiredLatestStatus
 rusqlite^0.31.00.32.1out of date
 serde^11.0.216up to date
 serde_derive^11.0.216up to date
 serde_json^11.0.133up to date

Crate viaduct-reqwest

Dependencies

(3 total, 1 outdated)

CrateRequiredLatestStatus
 reqwest^0.110.12.9out of date
 log^0.40.4.22up to date
 once_cell^1.51.20.2up to date

Crate sync_manager

Dependencies

(10 total, 1 outdated)

CrateRequiredLatestStatus
 thiserror^1.02.0.7out of date
 anyhow^1.01.0.94up to date
 lazy_static^1.41.5.0up to date
 log^0.40.4.22up to date
 url^2.22.5.4up to date
 serde^11.0.216up to date
 serde_derive^11.0.216up to date
 serde_json^11.0.133up to date
 parking_lot>=0.11, <=0.120.12.3up to date
 uniffi^0.28.20.28.3up to date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 uniffi^0.28.20.28.3up to date

Crate sync15

Dependencies

(12 total, 2 outdated)

CrateRequiredLatestStatus
 anyhow^1.01.0.94up to date
 base16^0.20.2.1up to date
 base64^0.210.22.1out of date
 lazy_static^1.41.5.0up to date
 log^0.40.4.22up to date
 serde^11.0.216up to date
 serde_derive^11.0.216up to date
 serde_json^11.0.133up to date
 serde_path_to_error^0.10.1.16up to date
 thiserror^1.02.0.7out of date
 uniffi^0.28.20.28.3up to date
 url^22.5.4up to date

Dev dependencies

(1 total, 1 outdated)

CrateRequiredLatestStatus
 env_logger^0.100.11.5out of date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 uniffi^0.28.20.28.3up to date

Crate tabs

Dependencies

(10 total, 2 outdated)

CrateRequiredLatestStatus
 anyhow^1.01.0.94up to date
 lazy_static^1.41.5.0up to date
 log^0.40.4.22up to date
 rusqlite^0.31.00.32.1out of date
 serde^11.0.216up to date
 serde_derive^11.0.216up to date
 serde_json^11.0.133up to date
 thiserror^1.02.0.7out of date
 uniffi^0.28.20.28.3up to date
 url^22.5.4up to date

Dev dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 env_logger^0.10.00.11.5out of date
 tempfile^3.13.14.0up to date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 uniffi^0.28.20.28.3up to date

Crate viaduct

Dependencies

(9 total, 2 outdated)

CrateRequiredLatestStatus
 url^22.5.4up to date
 log^0.40.4.22up to date
 serde^11.0.216up to date
 serde_json^11.0.133up to date
 once_cell^1.51.20.2up to date
 parking_lot>=0.11, <=0.120.12.3up to date
 prost^0.120.13.4out of date
 ffi-support^0.40.4.4up to date
 thiserror^1.02.0.7out of date

Crate webext-storage

Dependencies

(12 total, 2 outdated)

CrateRequiredLatestStatus
 anyhow^1.01.0.94up to date
 thiserror^1.02.0.7out of date
 ffi-support^0.40.4.4up to date
 lazy_static^1.41.5.0up to date
 log^0.40.4.22up to date
 parking_lot>=0.11, <=0.120.12.3up to date
 rusqlite^0.31.00.32.1out of date
 serde^11.0.216up to date
 serde_json^11.0.133up to date
 serde_derive^11.0.216up to date
 uniffi^0.28.20.28.3up to date
 url^2.12.5.4up to date

Dev dependencies

(3 total, 1 outdated)

CrateRequiredLatestStatus
 env_logger^0.100.11.5out of date
 tempfile^33.14.0up to date
 serde_json^11.0.133up to date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 uniffi^0.28.20.28.3up to date

Crate webext-storage-ffi

Dependencies

(4 total, all up-to-date)

CrateRequiredLatestStatus
 lazy_static^1.4.01.5.0up to date
 log^0.40.4.22up to date
 ffi-support^0.40.4.4up to date
 serde_json^11.0.133up to date

Crate cirrus

Dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 lazy_static^1.41.5.0up to date

Crate nimbus-experimenter

No external dependencies! 🙌

Crate megazord

Dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 lazy_static^1.41.5.0up to date

Crate megazord_ios

No external dependencies! 🙌

Crate megazord_focus

No external dependencies! 🙌

Crate protobuf-gen

Dependencies

(5 total, 3 outdated)

CrateRequiredLatestStatus
 clap^2.344.5.23out of date
 prost-build^0.120.13.4out of date
 serde^11.0.216up to date
 serde_derive^11.0.216up to date
 toml^0.50.8.19out of date

Crate embedded-uniffi-bindgen

Dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 uniffi^0.28.20.28.3up to date

Crate start-bindings

Dependencies

(8 total, 3 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 anyhow^11.0.94up to date
 camino^11.1.9up to date
 cargo_metadata^0.150.19.1out of date
 clap^4.24.5.23up to date
 rinja^0.3.30.3.5up to date
 serde_yaml ⚠️^0.80.9.34+deprecatedout of date
 toml^0.50.8.19out of date
 toml_edit^0.22.210.22.22up to date

Crate uniffi-bindgen-library-mode

Dependencies

(6 total, 1 outdated)

CrateRequiredLatestStatus
 uniffi^0.28.20.28.3up to date
 uniffi_bindgen^0.28.20.28.3up to date
 clap^44.5.23up to date
 cargo_metadata^0.150.19.1out of date
 camino^11.1.9up to date
 anyhow^11.0.94up to date

Crate swift_components_docs

No external dependencies! 🙌

Crate firefox-versioning

Dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 serde_json^1.01.0.133up to date
 thiserror^1.02.0.7out of date

Crate error-support-macros

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 syn^2.02.0.90up to date
 quote^1.01.0.37up to date
 proc-macro2^1.01.0.92up to date

Security Vulnerabilities

serde_yaml: Uncontrolled recursion leads to abort in deserialization

RUSTSEC-2018-0005

Affected versions of this crate did not properly check for recursion while deserializing aliases.

This allows an attacker to make a YAML file with an alias referring to itself causing an abort.

The flaw was corrected by checking the recursion depth.

chrono: Potential segfault in `localtime_r` invocations

RUSTSEC-2020-0159

Impact

Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.

Workarounds

No workarounds are known.

References

whoami: Stack buffer overflow with whoami on several Unix platforms

RUSTSEC-2024-0020

With versions of the whoami crate >= 0.5.3 and < 1.5.0, calling any of these functions leads to an immediate stack buffer overflow on illumos and Solaris:

  • whoami::username
  • whoami::realname
  • whoami::username_os
  • whoami::realname_os

With versions of the whoami crate >= 0.5.3 and < 1.0.1, calling any of the above functions also leads to a stack buffer overflow on these platforms:

  • Bitrig
  • DragonFlyBSD
  • FreeBSD
  • NetBSD
  • OpenBSD

This occurs because of an incorrect definition of the passwd struct on those platforms.

As a result of this issue, denial of service and data corruption have both been observed in the wild. The issue is possibly exploitable as well.

This vulnerability also affects other Unix platforms that aren't Linux or macOS.

This issue has been addressed in whoami 1.5.0.

For more information, see this GitHub issue.