RUSTSEC-2022-0048: xml-rs is Unmaintained

magic-wormhole / magic-wormhole.rs

Rust implementation of Magic Wormhole, with new features and enhancements

European Union Public License 1.2

648 stars 72 forks source link

Closed github-actions[bot] closed 1 year ago

github-actions[bot] commented 1 year ago

xml-rs is Unmaintained

Details
Status	unmaintained
Package	`xml-rs`
Version	`0.8.4`
URL	https://github.com/netvl/xml-rs/issues
Date	2022-01-26

xml-rs is a XML parser has open issues around parsing including integer overflows / panics that may or may not be an issue with untrusted data.

Together with these open issues with Unmaintained status xml-rs may or may not be suited to parse untrusted data.

See advisory page for additional details.

piegamesde commented 1 year ago

We don't use xml-rs directly, and it is only referenced as a build dependency. Therefore, we are not affected.