endringer (>=0.1.0, <=0.7.1) potentially affected by CVE-2025-31130 via gix (0.0.0)

gix CARGO version 0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on gix and may be impacted: - endringer =0.1.0, =0.7.1 Source cves: CVE-2025-31130 Source advisory: OSV:GHSA-2FRX-2596-X5R6...

a2 (>=0.2.0, <=0.8.1), aati (>=0.10.2, <=0.11.3) +5507 more potentially affected by CVE-2025-4432 via ring (>=0.13.5, <=0.17.9)

ring CARGO version =0.13.5, =0.2.0, =0.10.2, =0.1.0, =0.2.0-beta.4, =0.21.0-alpha.1, =0.1.1, =0.11.0, =0.0.1, =0.0.7-alpha.3, =0.0.7-alpha.2, =0.0.7-alpha.1, =0.0.7-alpha.3, =0.11.3, =0.1.27, =0.2.1 and more Source cves: CVE-2025-4432 Source advisory: OSV:RUSTSEC-2025-0009...

Linux Distros Unpatched Vulnerability : CVE-2022-36114

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cargo is a package manager for the rust programming language. It was discovered that Cargo did not limit the amount of data extracted from compressed archives. ...

afarray (>=0.1.0, <=0.15.1), b-table (>=0.1.0, <=0.2.1) +39 more potentially affected by unknown CVE via get-size-derive (>=0.1.2, <=0.1.3)

get-size-derive CARGO version =0.1.2, =0.1.0, =0.1.0, =0.1.0, =0.10.0, =0.1.0, =0.8.0, =0.1.0, =0.1.0, =0.3.1, =0.9.1, =0.0.6, =0.1.0, =0.8.0, =0.9.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0427...

ROS-20240729-09

Vulnerability in Cargo package manager of Rust programming language is related to ignoring umask when extracting archives created on UNIX-like systems. when retrieving archives created on UNIX-like systems. Exploitation of the vulnerability could allow an attacker, acting remotely, to execute...

ROS-20240729-11

A vulnerability in the Cargo package manager of the Rust programming language involves the injection of arbitrary HTML after including it in a report generated by Cargo. Exploitation of the vulnerability could allow an attacker, acting remotely, to execute arbitrary code...

OPENSUSE-SU-2024:11359-1 cargo-1.54.0-1.2 on GA media

These are all security issues fixed in the cargo-1.54.0-1.2 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11767-1 cargo1.56-1.56.1-4.1 on GA media

These are all security issues fixed in the cargo1.56-1.56.1-4.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11769-1 cargo1.58-1.58.0-2.1 on GA media

These are all security issues fixed in the cargo1.58-1.58.0-2.1 package on the GA media of openSUSE Tumbleweed...

ROS-20240402-20

A vulnerability in the Cargo package manager of the Rust programming language is associated with incorrect verification of the of the cryptographic signature. Exploitation of the vulnerability could allow an attacker acting remotely, affect the integrity of protected information via SSH protocol...

ashpd (>=0.2.0-beta-1, <=0.4.0) potentially affected by unknown CVE via gdkwayland (>=0.15.5, <=0.17.0)

gdkwayland CARGO version =0.15.5, =0.2.0-beta-1, =0.4.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0410...

etclient (0.3.0), evm-network (>=0.11.0-beta.0, <=0.11.0) +10 more potentially affected by CVE-2021-29511 via evm (>=0.7.1, <=0.17.3)

evm CARGO version =0.7.1, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.7.0, =2.0.0-alpha.3, =2.0.1 Source cves: CVE-2021-29511 Source advisory: OSV:GHSA-4JWQ-572W-4388...

amadeus (>=0.3.5, <=0.4.3), amadeus-parquet (>=0.3.5, <=0.4.3) +102 more potentially affected by unknown CVE via fehler (1.0.0)

fehler CARGO version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fehler and may be impacted: - amadeus =0.3.5, =0.3.5, =0.9.0, =0.9.0, =1.0.0, =0.0.2, =0.7.0, =0.5.0, =0.1.0, =0.1.0, =0.2.0, =0.3.2 and more Source cves: unknown CVE Source...

Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2023-109)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-109 advisory. 2024-02-15: CVE-2022-36113 was added to this advisory. 2024-02-15: CVE-2022-36114 was added to this advisory. Cargo is a package manager for the rust programming language. After a package is...

The vulnerability of the Cargo package manager in the Rust programming language, which allows attackers to compromise the integrity of the protected information

The vulnerability of the Cargo package manager in the Rust programming language is related to incorrect verification of the cryptographic signature. Exploiting this vulnerability allows a malicious actor to influence the integrity of the protected information via the SSH protocol...

ALPINE-CVE-2022-46176

Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle MITM attacks. This vulnerability has been assigned...

CVE-2022-36114 Extracting malicious crates can fill the file system

Cargo is a package manager for the rust programming language. It was discovered that Cargo did not limit the amount of data extracted from compressed archives. An attacker could upload to an alternate registry a specially crafted package that extracts way more data than its size also known as a...

auto-wasi (0.1.0), ceres-executor (>=0.1.0, <=0.2.0) +82 more potentially affected by CVE-2022-31146 via wasmtime (>=0.7.0, <=0.37.0)

wasmtime CARGO version =0.7.0, =0.1.0, =0.1.1, =0.5.3-0, =0.4.0-pre, =0.4.0-pre, =0.0.0, =0.40.1, =0.45.0, =0.10.0, =0.1.0, =0.1.0, =0.3.0 - inkpad-executor 0.1.0 and more Source cves: CVE-2022-31146 Source advisory: OSV:RUSTSEC-2022-0100...

abc (>=0.1.0, <=0.2.3), aerospike (>=0.0.1, <=1.3.0) +314 more potentially affected by unknown CVE via crossbeam (>=0.1.6, <=0.2.12)

crossbeam CARGO version =0.1.6, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.4.0, =0.4.0, =0.4.0, =0.0.6, =0.0.9 - bio 0.3.13 and more Source cves: unknown CVE Source advisory: OSV:GHSA-RWF4-GX62-RQFW...

tremor-language-server (>=0.7.3, <=0.7.4) potentially affected by CVE-2021-45701 +1 more via tremor-script (0.7.2)

tremor-script CARGO version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on tremor-script and may be impacted: - tremor-language-server =0.7.3, =0.7.4 Source cves: CVE-2021-45701, CVE-2021-45702 Source advisory: OSV:GHSA-9QVW-46GF-4FV8...