Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Code generated by flatbuffers' compiler is unsafe but not marked as such. See https://github.com/google/flatbuffers/issues/6627 for details. All users that use generated code by flatbuffers compiler are recommended to: 1. not expose flatbuffer generated code as part of their public APIs 2. audit their code and look for any usage of follow, push, or any method that uses them (e.g. selffollow). 3. Carefuly go through the crates' documentation to understand which "safe" APIs are not intended to be used.
Recommended action: Upgrade to 22.9.29 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust. readscalar (and readscalarat) can transmute values without unsafe blocks.
Recommended action: Upgrade to 2.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The implementation of impl Follow for bool allows to reinterpret arbitrary bytes as a bool. In Rust bool has stringent requirements for its in-memory representation. Use of this function allows to violate these requirements and invoke undefined behaviour in safe code.
Recommended action: Upgrade to 0.6.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.