Vulnerabilities

RUSTSEC-2024-0336

rustls::ConnectionCommon::complete_io could fall into an infinite loop based on network input

If a close_notify alert is received during a handshake, complete_io
does not terminate.

Callers which do not call complete_io are not affected.

rustls-tokio and rustls-ffi do not call complete_io
and are not affected.

rustls::Stream and rustls::StreamOwned types use
complete_io and are affected.

Warnings

RUSTSEC-2022-0077

claim is Unmaintained

The last release was in February 2021, almost two years ago.

The maintainer has been unresponsive regarding this crate for over a year.

A pending issue with claim's dependencies has made the crate difficult to use.

Possible Alternative(s)

The below list has not been vetted in any way and may or may not contain alternatives;

• claims, a direct fork of the claim crate

RUSTSEC-2024-0320

yaml-rust is unmaintained.

The maintainer seems unreachable.

Many issues and pull requests have been submitted over the years
without any response.

Alternatives

Consider switching to the actively maintained yaml-rust2 fork of the original project:

• yaml-rust2
• yaml-rust2 @ crates.io)