RUSTSEC-2016-0005 rust-crypto is unmaintained; switch to a modern alternative

Not scored Published

The rust-crypto crate is unmaintained and unresponsive, requiring developers to switch to modern alternatives like ring or RustCrypto.

Exploited in the wild
Not known
Login needed
Not stated
Attackable
Not stated
Victim action needed
Not stated
Fix
Available

What is RUSTSEC-2016-0005?

RUSTSEC-2016-0005 is a vulnerability in rust-crypto, published on 6 Sep 2016.

Official description

The rust-crypto crate has not seen a release or GitHub commit since 2016, and its author is unresponsive.

NOTE: The (old) rust-crypto crate (with hyphen) should not be confused with similarly named (new) RustCrypto GitHub Org (without hyphen). The GitHub Org is actively maintained.

We recommend you switch to one of the following crates instead, depending on which algorithms you need:

Which versions are affected by RUSTSEC-2016-0005?

1 open source package ship an affected version, including rust-crypto.

PackageAffectedFixed in
rust-crypto crates.ioFrom 0.0.0-00.2.37-0

How do I fix RUSTSEC-2016-0005?

Upgrade rust-crypto to 0.2.37-0 or later.

Is RUSTSEC-2016-0005 being exploited?

There is no known exploitation of RUSTSEC-2016-0005 in the wild and no public exploit code.

Sources

Is RUSTSEC-2016-0005 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free