zBlock-2 / summa-solvency-Turing

Apache License 2.0
0 stars 0 forks source link

Security vulnerability analysis for dependencies of summa-solvency package #9

Open sachindkagrawal15 opened 7 months ago

sachindkagrawal15 commented 7 months ago

1 Error and 4 warnings observed as below :

1 Error vulnerability found : Crate: shlex Version: 1.2.0 Title: Multiple issues involving quote API Date: 2024-01-21 ID: RUSTSEC-2024-0006 URL: https://rustsec.org/advisories/RUSTSEC-2024-0006 Solution: Upgrade to >=1.3.0 Dependency tree: shlex 1.2.0 └── bindgen 0.66.1 └── c-kzg 0.1.1 ├── revm-primitives 1.3.0 │ ├── revm-precompile 2.2.0 │ │ └── revm 3.5.0 │ │ └── halo2_solidity_verifier 0.1.0 │ │ └── summa-solvency 0.1.0 │ └── revm-interpreter 1.3.0 │ └── revm 3.5.0 └── revm-precompile 2.2.0

4 warnings details : Crate: serde_cbor Version: 0.11.2 Warning: unmaintained Title: serde_cbor is unmaintained Date: 2021-08-15 ID: RUSTSEC-2021-0127 URL: https://rustsec.org/advisories/RUSTSEC-2021-0127 Dependency tree: serde_cbor 0.11.2 └── criterion 0.3.6 └── summa-solvency 0.1.0

Crate: atty Version: 0.2.14 Warning: unsound Title: Potential unaligned read Date: 2021-07-04 ID: RUSTSEC-2021-0145 URL: https://rustsec.org/advisories/RUSTSEC-2021-0145 Dependency tree: atty 0.2.14 └── criterion 0.3.6 └── summa-solvency 0.1.0

Crate: const-cstr Version: 0.3.0 Warning: unsound Title: const-cstr is Unmaintained Date: 2023-03-12 ID: RUSTSEC-2023-0020 URL: https://rustsec.org/advisories/RUSTSEC-2023-0020 Dependency tree: const-cstr 0.3.0 └── yeslogic-fontconfig-sys 3.2.0 └── font-kit 0.11.0 └── plotters 0.3.5 ├── summa-solvency 0.1.0 ├── halo2_proofs 0.2.0 │ ├── summa-solvency 0.1.0 │ ├── halo2_solidity_verifier 0.1.0 │ │ └── summa-solvency 0.1.0 │ └── halo2_gadgets 0.2.0 │ └── summa-solvency 0.1.0 └── criterion 0.3.6 └── summa-solvency 0.1.0

Crate: iana-time-zone Version: 0.1.59 Warning: yanked Dependency tree: iana-time-zone 0.1.59 └── chrono 0.4.31 ├── plotters 0.3.5 │ ├── summa-solvency 0.1.0 │ ├── halo2_proofs 0.2.0 │ │ ├── summa-solvency 0.1.0 │ │ ├── halo2_solidity_verifier 0.1.0 │ │ │ └── summa-solvency 0.1.0 │ │ └── halo2_gadgets 0.2.0 │ │ └── summa-solvency 0.1.0 │ └── criterion 0.3.6 │ └── summa-solvency 0.1.0 ├── ethers-etherscan 2.0.12 │ └── ethers 2.0.11 │ └── summa-solvency 0.1.0 └── ethers-core 2.0.12 ├── ethers-solc 2.0.12 │ ├── ethers-etherscan 2.0.12 │ └── ethers 2.0.11 ├── ethers-signers 2.0.11 │ ├── ethers-middleware 2.0.11 │ │ └── ethers 2.0.11 │ └── ethers 2.0.11 ├── ethers-providers 2.0.11 │ ├── ethers-middleware 2.0.11 │ ├── ethers-contract 2.0.11 │ │ ├── ethers-middleware 2.0.11 │ │ └── ethers 2.0.11 │ └── ethers 2.0.11 ├── ethers-middleware 2.0.11 ├── ethers-etherscan 2.0.12 ├── ethers-contract-derive 2.0.12 │ └── ethers-contract 2.0.11 ├── ethers-contract-abigen 2.0.12 │ ├── ethers-contract-derive 2.0.12 │ └── ethers-contract 2.0.11 ├── ethers-contract 2.0.11 ├── ethers-addressbook 2.0.12 │ └── ethers 2.0.11 └── ethers 2.0.11