RUSTSEC-2021-0145

[critkitten]

user@linux ~ $ osv-scanner rage/
Scanning dir rage/
Scanning /home/user/rage/ at commit 3ff541a0a59864b782aeaca4d33cee1c8d61c2e9
Scanned /home/user/rage/Cargo.lock file and found 304 packages
╭───────────────────────────────────────────────────┬───────────┬────────────┬─────────┬─────────────────╮
│ OSV URL (ID IN BOLD)                              │ ECOSYSTEM │ PACKAGE    │ VERSION │ SOURCE          │
├───────────────────────────────────────────────────┼───────────┼────────────┼─────────┼─────────────────┤
│ https://osv.dev/vulnerability/RUSTSEC-2021-0145   │ crates.io │ atty       │ 0.2.14  │ rage/Cargo.lock │
│ https://osv.dev/vulnerability/RUSTSEC-2021-0127   │ crates.io │ serde_cbor │ 0.11.2  │ rage/Cargo.lock │
│ https://osv.dev/vulnerability/GHSA-wcg3-cvx6-7396 │ crates.io │ time       │ 0.1.44  │ rage/Cargo.lock │
│ https://osv.dev/vulnerability/RUSTSEC-2020-0071   │           │            │         │                 │
╰───────────────────────────────────────────────────┴───────────┴────────────┴─────────┴─────────────────╯

[str4d]

Two of the three above are duplicates:

• RUSTSEC-2020-0071: Potential segfault in the time crate #266
• RUSTSEC-2021-0127: serde_cbor is unmaintained #275

I was already tracking the atty issue separately, but looks like there wasn't an open issue for it, so I'll use this one.