RUSTSEC-2024-0449 unsafe-libyaml is unmaintained
The unsafe-libyaml library is unmaintained and archived, requiring users to migrate to safe Rust alternatives to avoid unpatched bugs.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Not stated
- Victim action needed
- Not stated
- Fix
- None listed
What is RUSTSEC-2024-0449?
RUSTSEC-2024-0449 is a vulnerability in unsafe-libyaml, published on 25 Mar 2024.
Official description
The repository was archived by its owner on 2024-03-25 and is read-only. The last release is 0.2.11 (March 2024).
unsafe-libyaml is a machine translation of libyaml's C code into unsafe
Rust (c2rust). Bugs found in it will not be fixed upstream. It is used by
serde_yaml (itself deprecated) and by forks such as serde_yaml_ng.
Alternatives
Consider a YAML parser written in safe Rust, for example:
- saphyr (serde-saphyr for serde users)
- noyalib
Which versions are affected by RUSTSEC-2024-0449?
1 open source package ship an affected version, including unsafe-libyaml.
| Package | Affected | Fixed in |
|---|---|---|
unsafe-libyaml crates.io | From 0.0.0-0 | None |
How do I fix RUSTSEC-2024-0449?
No fix has been published for RUSTSEC-2024-0449 yet. Limit exposure of the affected software until one is available.
Is RUSTSEC-2024-0449 being exploited?
There is no known exploitation of RUSTSEC-2024-0449 in the wild and no public exploit code.