RUSTSEC-2021-0133

    Dashboard / Vulnerabilities / RUSTSEC-2021-0133

    RUSTSEC-2021-0133

    Published: 25 Dec 2021Last Modified: 25 Dec 2021

    Summary: cargo-download is unmaintained

    Details: The cargo download subcommand (via cargo-download crate) is broken and maintainer has disappeared from GitHub and hasn't had any commits for a year. Using this downloader will result to corrupted crates. Maintainer has not responded to maintenance takeover. Just use wget / curl directly.

    References: https://crates.io/crates/cargo-download, https://rustsec.org/advisories/RUSTSEC-2021-0133.html, https://github.com/Xion/cargo-download

    Affected packages

    Package

    Name: cargo-download

    Purl: pkg:cargo/cargo-download

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.0.0-0
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    RUSTSEC-2021-0133 | CVE-DB