This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate susyp2p

Dependencies

(8 total, 4 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 bytes^0.41.1.0out of date
 futures^0.10.3.21out of date
 lazy_static^1.21.4.0up to date
 parking_lot^0.70.12.0out of date
 smallvec ⚠️^0.61.8.0out of date
 tokio-codec^0.10.1.2up to date
 tokio-executor^0.10.1.10up to date
 tokio-io^0.10.1.13up to date

Dev dependencies

(5 total, 3 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 env_logger^0.6.00.9.0out of date
 rand^0.60.8.5out of date
 tokio ⚠️^0.11.18.2out of date
 tokio-stdin-stdout^0.10.1.5up to date
 void^1.01.0.2up to date

Crate susy-multiaddr

Dependencies

(7 total, 3 outdated)

CrateRequiredLatestStatus
 arrayref^0.30.3.6up to date
 bs58^0.2.00.4.0out of date
 byteorder^1.3.11.4.3up to date
 bytes^0.4.121.1.0out of date
 data-encoding^2.12.3.2up to date
 serde^1.0.701.0.137up to date
 unsigned-varint^0.20.7.1out of date

Dev dependencies

(6 total, 3 outdated)

CrateRequiredLatestStatus
 bincode^11.3.3up to date
 bs58^0.2.00.4.0out of date
 data-encoding^22.3.2up to date
 quickcheck^0.8.11.0.3out of date
 rand^0.6.50.8.5out of date
 serde_json^1.01.0.81up to date

Crate susy-multihash

Dependencies

(6 total, 6 outdated)

CrateRequiredLatestStatus
 blake2^0.80.10.4out of date
 rand^0.60.8.5out of date
 sha-1^0.80.10.0out of date
 sha2^0.80.10.2out of date
 sha3^0.80.10.1out of date
 unsigned-varint^0.20.7.1out of date

Crate susyp2p-mplex

Dependencies

(8 total, 4 outdated)

CrateRequiredLatestStatus
 bytes^0.4.51.1.0out of date
 fnv^1.01.0.7up to date
 futures^0.10.3.21out of date
 log^0.40.4.17up to date
 parking_lot^0.70.12.0out of date
 tokio-codec^0.10.1.2up to date
 tokio-io^0.10.1.13up to date
 unsigned-varint^0.2.10.7.1out of date

Dev dependencies

(1 total, 1 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 tokio ⚠️^0.11.18.2out of date

Crate susyp2p-identify

Dependencies

(12 total, 6 outdated, 2 possibly insecure)

CrateRequiredLatestStatus
 bytes^0.41.1.0out of date
 fnv^11.0.7up to date
 futures^0.10.3.21out of date
 log^0.4.10.4.17up to date
 parking_lot^0.70.12.0out of date
 protobuf ⚠️^2.33.0.2out of date
 smallvec ⚠️^0.61.8.0out of date
 tokio-codec^0.10.1.2up to date
 tokio-io^0.1.00.1.13up to date
 tokio-timer^0.2.60.2.13up to date
 unsigned-varint^0.2.10.7.1out of date
 void^1.01.0.2up to date

Dev dependencies

(2 total, 2 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 rand^0.60.8.5out of date
 tokio ⚠️^0.11.18.2out of date

Crate susyp2p-kad

Dependencies

(17 total, 9 outdated, 2 possibly insecure)

CrateRequiredLatestStatus
 arrayref^0.30.3.6up to date
 arrayvec^0.4.70.7.2out of date
 bs58^0.2.00.4.0out of date
 bigint^4.24.4.3up to date
 bytes^0.41.1.0out of date
 fnv^1.01.0.7up to date
 futures^0.10.3.21out of date
 log^0.40.4.17up to date
 parking_lot^0.70.12.0out of date
 protobuf ⚠️^2.33.0.2out of date
 rand^0.6.00.8.5out of date
 smallvec ⚠️^0.61.8.0out of date
 tokio-codec^0.10.1.2up to date
 tokio-io^0.10.1.13up to date
 tokio-timer^0.2.60.2.13up to date
 unsigned-varint^0.2.10.7.1out of date
 void^1.01.0.2up to date

Dev dependencies

(1 total, 1 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 tokio ⚠️^0.11.18.2out of date

Crate susyp2p-floodsub

Dependencies

(11 total, 8 outdated, 2 possibly insecure)

CrateRequiredLatestStatus
 bs58^0.2.00.4.0out of date
 bytes^0.41.1.0out of date
 cuckoofilter^0.3.20.5.0out of date
 fnv^1.01.0.7up to date
 futures^0.10.3.21out of date
 protobuf ⚠️^2.33.0.2out of date
 rand^0.60.8.5out of date
 smallvec ⚠️^0.6.51.8.0out of date
 tokio-codec^0.10.1.2up to date
 tokio-io^0.10.1.13up to date
 unsigned-varint^0.2.10.7.1out of date

Crate susyp2p-ping

Dependencies

(10 total, 5 outdated)

CrateRequiredLatestStatus
 arrayvec^0.40.7.2out of date
 bytes^0.41.1.0out of date
 log^0.4.10.4.17up to date
 futures^0.10.3.21out of date
 parking_lot^0.70.12.0out of date
 rand^0.60.8.5out of date
 tokio-codec^0.10.1.2up to date
 tokio-io^0.10.1.13up to date
 tokio-timer^0.2.60.2.13up to date
 void^1.01.0.2up to date

Dev dependencies

(3 total, 2 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 quickcheck^0.81.0.3out of date
 tokio ⚠️^0.11.18.2out of date
 tokio-tcp^0.10.1.4up to date

Crate susyp2p-plaintext

Dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 futures^0.10.3.21out of date
 void^11.0.2up to date

Crate susyp2p-ratelimit

Dependencies

(5 total, 1 outdated)

CrateRequiredLatestStatus
 aio-limited^0.10.1.1up to date
 futures^0.10.3.21out of date
 log^0.40.4.17up to date
 tokio-executor^0.10.1.10up to date
 tokio-io^0.10.1.13up to date

Crate susyp2p-core

Dependencies

(22 total, 13 outdated, 3 possibly insecure)

CrateRequiredLatestStatus
 asn1_der ⚠️^0.6.10.7.5out of date
 bs58^0.2.00.4.0out of date
 bytes^0.41.1.0out of date
 ed25519-dalek^1.0.0-pre.11.0.1up to date
 failure^0.10.1.8up to date
 fnv^1.01.0.7up to date
 lazy_static^1.21.4.0up to date
 log^0.40.4.17up to date
 futures^0.10.3.21out of date
 parking_lot^0.70.12.0out of date
 protobuf ⚠️^2.33.0.2out of date
 quick-error^1.22.0.1out of date
 rand^0.60.8.5out of date
 secp256k1^0.120.22.1out of date
 sha2^0.8.00.10.2out of date
 smallvec ⚠️^0.61.8.0out of date
 tokio-executor^0.1.40.1.10up to date
 tokio-io^0.10.1.13up to date
 tokio-timer^0.20.2.13up to date
 unsigned-varint^0.20.7.1out of date
 void^11.0.2up to date
 zeroize^0.51.5.5out of date

Dev dependencies

(8 total, 4 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 env_logger^0.60.9.0out of date
 rand^0.60.8.5out of date
 quickcheck^0.81.0.3out of date
 tokio ⚠️^0.11.18.2out of date
 tokio-codec^0.10.1.2up to date
 tokio-timer^0.20.2.13up to date
 assert_matches^1.31.5.0up to date
 tokio-mock-task^0.10.1.1up to date

Crate susyp2p-core-derive

Dependencies

(2 total, 2 outdated)

CrateRequiredLatestStatus
 syn^0.15.221.0.95out of date
 quote^0.61.0.18out of date

Dev dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 void^1.01.0.2up to date

Crate susyp2p-secio

Dependencies

(15 total, 12 outdated, 2 possibly insecure)

CrateRequiredLatestStatus
 asn1_der ⚠️^0.6.10.7.5out of date
 bytes^0.41.1.0out of date
 futures^0.10.3.21out of date
 log^0.4.60.4.17up to date
 protobuf ⚠️^2.33.0.2out of date
 rand^0.6.50.8.5out of date
 secp256k1^0.120.22.1out of date
 aes-ctr^0.30.99.99out of date
 aesni^0.60.99.99out of date
 twofish^0.2.00.7.1out of date
 ctr^0.30.9.1out of date
 lazy_static^1.2.01.4.0up to date
 tokio-io^0.1.00.1.13up to date
 sha2^0.8.00.10.2out of date
 hmac^0.7.00.12.1out of date

Dev dependencies

(3 total, 2 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 criterion^0.20.3.5out of date
 tokio ⚠️^0.11.18.2out of date
 tokio-tcp^0.10.1.4up to date

Crate susyp2p-uds

No external dependencies! 🙌

Crate susyp2p-websocket

Dependencies

(3 total, 1 outdated)

CrateRequiredLatestStatus
 futures^0.10.3.21out of date
 log^0.4.10.4.17up to date
 tokio-io^0.10.1.13up to date

Crate susyp2p-yamux

Dependencies

(4 total, 2 outdated)

CrateRequiredLatestStatus
 futures^0.10.3.21out of date
 log^0.40.4.17up to date
 tokio-io^0.10.1.13up to date
 yamux^0.2.00.10.1out of date

Crate susyp2p-mdns

Dependencies

(12 total, 3 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 data-encoding^2.02.3.2up to date
 dns-parser^0.80.8.0up to date
 futures^0.10.3.21out of date
 log^0.40.4.17up to date
 net2^0.20.2.37up to date
 rand^0.60.8.5out of date
 smallvec ⚠️^0.61.8.0out of date
 tokio-io^0.10.1.13up to date
 tokio-reactor^0.10.1.12up to date
 tokio-timer^0.20.2.13up to date
 tokio-udp^0.10.1.6up to date
 void^1.01.0.2up to date

Dev dependencies

(1 total, 1 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 tokio ⚠️^0.11.18.2out of date

Crate multistream-select

Dependencies

(7 total, 4 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 bytes^0.41.1.0out of date
 futures^0.10.3.21out of date
 log^0.40.4.17up to date
 smallvec ⚠️^0.61.8.0out of date
 tokio-codec^0.10.1.2up to date
 tokio-io^0.10.1.13up to date
 unsigned-varint^0.2.10.7.1out of date

Dev dependencies

(2 total, 1 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 tokio ⚠️^0.11.18.2out of date
 tokio-tcp^0.10.1.4up to date

Crate peer-id-generator

Dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 num_cpus^1.81.13.1up to date
 rand^0.60.8.5out of date

Crate rw-stream-sink

Dependencies

(3 total, 2 outdated)

CrateRequiredLatestStatus
 bytes^0.41.1.0out of date
 futures^0.10.3.21out of date
 tokio-io^0.10.1.13up to date

Crate susyp2p-noise

Dependencies

(10 total, 7 outdated)

CrateRequiredLatestStatus
 curve25519-dalek^13.2.1out of date
 futures^0.10.3.21out of date
 lazy_static^1.21.4.0up to date
 log^0.40.4.17up to date
 rand^0.6.50.8.5out of date
 ring^0.140.16.20out of date
 snow^0.5.10.9.0out of date
 tokio-io^0.10.1.13up to date
 x25519-dalek^0.51.2.0out of date
 zeroize^0.51.5.5out of date

Dev dependencies

(4 total, 3 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 env_logger^0.60.9.0out of date
 quickcheck^0.81.0.3out of date
 tokio ⚠️^0.11.18.2out of date
 sodiumoxide^0.20.2.7up to date

Crate susyp2p-observed-address

Dependencies

(5 total, 3 outdated)

CrateRequiredLatestStatus
 bytes^0.41.1.0out of date
 futures^0.10.3.21out of date
 tokio-codec^0.10.1.2up to date
 tokio-io^0.10.1.13up to date
 unsigned-varint^0.2.10.7.1out of date

Dev dependencies

(1 total, 1 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 tokio ⚠️^0.11.18.2out of date

Crate susyp2p-dns

Dependencies

(4 total, 1 outdated)

CrateRequiredLatestStatus
 log^0.4.10.4.17up to date
 futures^0.10.3.21out of date
 tokio-dns-unofficial^0.40.4.0up to date
 tokio-io^0.10.1.13up to date

Dev dependencies

(1 total, 1 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 tokio ⚠️^0.11.18.2out of date

Crate susyp2p-tcp

Dependencies

(6 total, 1 outdated)

CrateRequiredLatestStatus
 get_if_addrs^0.5.30.5.3up to date
 log^0.4.10.4.17up to date
 futures^0.10.3.21out of date
 tk-listen^0.2.00.2.1up to date
 tokio-io^0.10.1.13up to date
 tokio-tcp^0.10.1.4up to date

Dev dependencies

(1 total, 1 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 tokio ⚠️^0.11.18.2out of date

Security Vulnerabilities

protobuf: Out of Memory in stream::read_raw_bytes_into()

RUSTSEC-2019-0003

Affected versions of this crate called Vec::reserve() on user-supplied input.

This allows an attacker to cause an Out of Memory condition while calling the vulnerable method on untrusted data.

asn1_der: Processing of maliciously crafted length fields causes memory allocation SIGABRTs

RUSTSEC-2019-0007

Affected versions of this crate tried to preallocate a vector for an arbitrary amount of bytes announced by the ASN.1-DER length field without further checks.

This allows an attacker to trigger a SIGABRT by creating length fields that announce more bytes than the allocator can provide.

The flaw was corrected by not preallocating memory.

smallvec: Buffer overflow in SmallVec::insert_many

RUSTSEC-2021-0003

A bug in the SmallVec::insert_many method caused it to allocate a buffer that was smaller than needed. It then wrote past the end of the buffer, causing a buffer overflow and memory corruption on the heap.

This bug was only triggered if the iterator passed to insert_many yielded more items than the lower bound returned from its size_hint method.

The flaw was corrected in smallvec 0.6.14 and 1.6.1, by ensuring that additional space is always reserved for each item inserted. The fix also simplified the implementation of insert_many to use less unsafe code, so it is easier to verify its correctness.

Thank you to Yechan Bae (@Qwaz) and the Rust group at Georgia Tech’s SSLab for finding and reporting this bug.

tokio: Data race when sending and receiving after closing a `oneshot` channel

RUSTSEC-2021-0124

If a tokio::sync::oneshot channel is closed (via the oneshot::Receiver::close method), a data race may occur if the oneshot::Sender::send method is called while the corresponding oneshot::Receiver is awaited or calling try_recv.

When these methods are called concurrently on a closed channel, the two halves of the channel can concurrently access a shared memory location, resulting in a data race. This has been observed to cause memory corruption.

Note that the race only occurs when both halves of the channel are used after the Receiver half has called close. Code where close is not used, or where the Receiver is not awaited and try_recv is not called after calling close, is not affected.

See tokio#4225 for more details.