RUSTSEC-2017-0007 lz4-compress is unmaintained
The lz4-compress crate is unmaintained, posing supply chain risks; developers should migrate to maintained alternatives like lz4-compression.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Not stated
- Victim action needed
- Not stated
- Fix
- None listed
What is RUSTSEC-2017-0007?
RUSTSEC-2017-0007 is a vulnerability in lz4-compress, published on 17 Apr 2017.
Official description
According to the developers this crate is no longer maintained.
The suggested alternative is lz4-compression, a maintained fork of lz4-compress.
See also lz-fear which is compatible with the reference LZ4 implementation in C, but not with lz4-compress.
Which versions are affected by RUSTSEC-2017-0007?
1 open source package ship an affected version, including lz4-compress.
| Package | Affected | Fixed in |
|---|---|---|
lz4-compress crates.io | From 0.0.0-0 | None |
How do I fix RUSTSEC-2017-0007?
No fix has been published for RUSTSEC-2017-0007 yet. Limit exposure of the affected software until one is available.
Is RUSTSEC-2017-0007 being exploited?
There is no known exploitation of RUSTSEC-2017-0007 in the wild and no public exploit code.