Rust advisories / rsa-export
UnmaintainedRUSTSEC-2024-0333 · rsa-export
RUSTSEC-2024-0333: `rsa-export` is unmaintained
Short answerNot a bug report: rsa-export is no longer maintained, so future security issues will not be fixed. Plan to move to a maintained alternative.
| Crate | rsa-export |
|---|---|
| Type | Unmaintained |
| Affected versions | Every version. |
| Fixed in | not applicable (the crate is unmaintained) |
| Severity | not scored |
| Published | 2024-04-06 |
| Last changed | 2024-04-12 |
| Also known as | none |
What to do
- Look for a maintained fork or alternative crate.
- If you cannot move yet, acknowledge it in your audit config so CI stays green while you plan: add
"RUSTSEC-2024-0333"toignorein.cargo/audit.tomlordeny.toml, with a comment saying why. - Find who pulls it in:
cargo tree -i rsa-export.
Details from the advisory
This crate has been deprecated in favour of using the native support for exporting RSA keys into the standard PEM format. See docs.rs documentation.
In addition to that, the operations in this crate (arithmetic and Base64 encoding) are not done in constant-time, potentially exposing the user to sidechannel attacks.
References
- Package: crates.io/crates/rsa-export
- Advisory: rustsec.org/advisories/RUSTSEC-2024-0333.html
- Package: crates.io/crates/rsa-export/0.3.3
- Web: gitlab.com/smallglitch/rsa-export/-/commit/e29f17170d655a6f62eca8bf1f64ef0ce5807058
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?