This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate greenglas

Dependencies

(3 total, 1 outdated)

CrateRequiredLatestStatus
 image=0.23.120.25.4out of date
 murmurhash3^0.0.50.0.5up to date
 modifier^0.10.1.0up to date

Crate coaster

Dependencies

(7 total, 1 outdated)

CrateRequiredLatestStatus
 libc^0.20.2.161up to date
 bitflags^12.6.0out of date
 enum_primitive^0.10.1.1up to date
 byteorder^11.5.0up to date
 num^0.40.4.3up to date
 lazy_static^11.5.0up to date
 thiserror^1.01.0.68up to date

Dev dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 trybuild^1.01.0.101up to date

Crate coaster-nn

Dependencies

(5 total, all up-to-date)

CrateRequiredLatestStatus
 libc^0.20.2.161up to date
 log^0.40.4.22up to date
 rand^0.80.8.5up to date
 rand_chacha^0.3.00.3.1up to date
 thiserror^1.01.0.68up to date

Dev dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 env_logger^0.90.11.5out of date
 num^0.40.4.3up to date

Crate coaster-blas

Dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 log^0.40.4.22up to date

Crate juice

Dependencies

(5 total, 1 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 log^0.40.4.22up to date
 rand^0.80.8.5up to date
 num^0.40.4.3up to date
 capnp ⚠️^0.140.20.3out of date
 timeit^0.10.1.2up to date

Dev dependencies

(1 total, 1 outdated)

CrateRequiredLatestStatus
 env_logger^0.90.11.5out of date

Build dependencies

(1 total, 1 outdated)

CrateRequiredLatestStatus
 capnpc^0.140.20.0out of date

Crate rust-blas

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 num^0.40.4.3up to date
 num-complex^0.40.4.6up to date
 libc^0.20.2.161up to date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 pkg-config^0.30.3.31up to date

Crate rcudnn

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 libc^0.20.2.161up to date
 num^0.40.4.3up to date
 thiserror^1.01.0.68up to date

Dev dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 env_logger^0.90.11.5out of date
 log^0.40.4.22up to date

Crate rcudnn-sys

Dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 libc^0.20.2.161up to date

Build dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 pkg-config^0.30.3.31up to date
 bindgen^0.60.10.70.1out of date

Crate rcublas

Dependencies

(4 total, all up-to-date)

CrateRequiredLatestStatus
 libc^0.20.2.161up to date
 lazy_static^11.5.0up to date
 log^0.40.4.22up to date
 thiserror^1.01.0.68up to date

Dev dependencies

(1 total, 1 outdated)

CrateRequiredLatestStatus
 env_logger^0.90.11.5out of date

Crate rcublas-sys

Dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 libc^0.20.2.161up to date

Build dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 pkg-config^0.30.3.31up to date
 bindgen^0.60.10.70.1out of date

Crate juice-utils

Dependencies

(4 total, 2 outdated)

CrateRequiredLatestStatus
 reqwest^0.110.12.9out of date
 flate2^11.0.34up to date
 fs-err^23.0.0out of date
 log^0.40.4.22up to date

Crate example-rnn-regression

Dependencies

(6 total, 2 outdated)

CrateRequiredLatestStatus
 csv^1.11.3.0up to date
 serde^11.0.214up to date
 env_logger^0.90.11.5out of date
 log^0.40.4.22up to date
 docopt^1.11.1.1up to date
 fs-err^23.0.0out of date

Crate example-mnist-classification

Dependencies

(13 total, 4 outdated, 2 possibly insecure)

CrateRequiredLatestStatus
 csv^11.3.0up to date
 hyper ⚠️^0.141.5.0out of date
 hyper-rustls^0.230.27.3out of date
 futures^0.30.3.31up to date
 futures-util^0.30.3.31up to date
 tokio ⚠️^11.41.0maybe insecure
 flate2^11.0.34up to date
 mnist^0.5.00.6.0out of date
 log^0.40.4.22up to date
 env_logger^0.90.11.5out of date
 timeit^0.1.20.1.2up to date
 docopt^11.1.1up to date
 serde^11.0.214up to date

Security Vulnerabilities

hyper: Lenient `hyper` header parsing of `Content-Length` could allow request smuggling

RUSTSEC-2021-0078

hyper's HTTP header parser accepted, according to RFC 7230, illegal contents inside Content-Length headers. Due to this, upstream HTTP proxies that ignore the header may still forward them along if it chooses to ignore the error.

To be vulnerable, hyper must be used as an HTTP/1 server and using an HTTP proxy upstream that ignores the header's contents but still forwards it. Due to all the factors that must line up, an attack exploiting this vulnerability is unlikely.

hyper: Integer overflow in `hyper`'s parsing of the `Transfer-Encoding` header leads to data loss

RUSTSEC-2021-0079

When decoding chunk sizes that are too large, hyper's code would encounter an integer overflow. Depending on the situation, this could lead to data loss from an incorrect total size, or in rarer cases, a request smuggling attack.

To be vulnerable, you must be using hyper for any HTTP/1 purpose, including as a client or server, and consumers must send requests or responses that specify a chunk size greater than 18 exabytes. For a possible request smuggling attack to be possible, any upstream proxies must accept a chunk size greater than 64 bits.

capnp: out-of-bounds read possible when setting list-of-pointers

RUSTSEC-2022-0068

If a message consumer expects data of type "list of pointers", and if the consumer performs certain specific actions on such data, then a message producer can cause the consumer to read out-of-bounds memory. This could trigger a process crash in the consumer, or in some cases could allow exfiltration of private in-memory data.

The C++ Cap'n Proto library is also affected by this bug. See the advisory on the main Cap'n Proto repo for a succinct description of the exact circumstances in which the problem can arise.

tokio: reject_remote_clients Configuration corruption

RUSTSEC-2023-0001

On Windows, configuring a named pipe server with pipe_mode will force ServerOptions::reject_remote_clients as false.

This drops any intended explicit configuration for the reject_remote_clients that may have been set as true previously.

The default setting of reject_remote_clients is normally true meaning the default is also overridden as false.

Workarounds

Ensure that pipe_mode is set first after initializing a ServerOptions. For example:

let mut opts = ServerOptions::new();
opts.pipe_mode(PipeMode::Message);
opts.reject_remote_clients(true);