poszu / zero2prod-email-notif-svc Goto Github PK

stdweb is unmaintained

Details
Status	unmaintained
Package	stdweb
Version	0.4.20
URL	koute/stdweb#403
Date	2020-05-04

The author of the stdweb crate is unresponsive.

Maintained alternatives:

• wasm-bindgen
• js-sys
• web-sys

See advisory page for additional details.

Use-after-free in Framed due to lack of pinning

Details
Package	actix-codec
Version	0.4.0-beta.1
URL	actix/actix-net#91
Date	2020-01-30
Patched versions	>=0.3.0-beta.1

Affected versions of this crate did not require the buffer wrapped in Framed to be pinned,
but treated it as if it had a fixed location in memory. This may result in a use-after-free.

The flaw was corrected by making the affected functions accept Pin<&mut Self> instead of &mut self.

See advisory page for additional details.

Use-after-free in BodyStream due to lack of pinning

Details
Package	actix-http
Version	3.0.0-beta.4
URL	actix/actix-web#1321
Date	2020-01-24
Patched versions	>=2.0.0-alpha.1

Affected versions of this crate did not require the buffer wrapped in BodyStream to be pinned,
but treated it as if it had a fixed location in memory. This may result in a use-after-free.

The flaw was corrected by making the trait MessageBody require Unpin
and making poll_next() function accept Pin<&mut Self> instead of &mut self.

See advisory page for additional details.

Multiple memory safety issues

Details
Package	actix-web
Version	4.0.0-beta.4
URL	actix/actix-web#289
Date	2018-06-08
Patched versions	>=0.7.15

Affected versions contain multiple memory safety issues, such as:

• Unsoundly coercing immutable references to mutable references
• Unsoundly extending lifetimes of strings
• Adding the Send marker trait to objects that cannot be safely sent between threads

This may result in a variety of memory corruption scenarios, most likely use-after-free.

A signficant refactoring effort has been conducted to resolve these issues.

See advisory page for additional details.

dirs is unmaintained, use dirs-next instead

Details
Status	unmaintained
Package	dirs
Version	3.0.1
URL	https://github.com/dirs-dev/dirs-rs
Date	2020-10-16

The dirs crate is not maintained any more;
use dirs-next instead.

See advisory page for additional details.