Important: rust

Issue Overview: RUSTSEC-2024-0006 NOTE: https://rustsec.org/advisories/RUSTSEC-2024-0006.html NOTE: https://github.com/comex/rust-shlex/security/advisories/GHSA-r7qv-8r2h-pg27 Affected Packages: rust Issue Correction: Run dnf update rust --releasever 2023.4.20240319 or dnf update --advisory...

BeerHolderBot (>=0.3.5 <=0.3.8), BiliupApi (>=0.1.0 <=0.1.7) +3724 more potentially affected by unknown CVE via yaml-rust (>=0.2.2 <=0.4.5)

yaml-rust CARGO version =0.2.2, =0.3.5, =0.1.0, =0.1.0, =0.1.0, =0.9.0, =1.0.0, =0.1.0, =0.0.9, =0.0.1, =0.0.1, =0.2.0-alpha.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0320...

BrewStillery (>=1.0.0 <=6.2.0), Druid_task1 (=0.1.0) +304 more potentially affected by unknown CVE via gtk (>=0.0.7 <=0.9.2)

gtk CARGO version =0.0.7, =1.0.0, =0.13.2, =1.0.0, =0.2.0, =0.1.0, =0.1.2, =0.2.0, =0.21.0, =0.30.1 - avr-vm =0.1.0 - awl =0.0.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0415...

crayon-audio (>=0.6.0 <=0.7.1) potentially affected by unknown CVE via crayon (>=0.6.0 <=0.7.1)

crayon CARGO version =0.6.0, =0.6.0, =0.7.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0018...

alerter (>=0.3.0 <=0.3.1), maruc (=0.1.0) +9 more potentially affected by CVE-2024-52813 via matrix-sdk-crypto (>=0.1.0 <=0.5.0)

matrix-sdk-crypto CARGO version =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.10-alpha, =0.13.0, =0.13.1 Source cves: CVE-2024-52813 Source advisory: OSV:RUSTSEC-2024-0434...

RUSTSEC-2023-0105 `windowsservice` was removed from crates.io for malicious code

This crate was part of a typosquatting malware cluster published by the user TerryDavisSoldier to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longe...

RUSTSEC-2023-0114 `tiny-server` was removed from crates.io for malicious code

This crate was part of a typosquatting malware cluster published by the malicious user http-tiny and contained a malware payload in build.rs to exfiltrate host information to the attacker. This advisory is to retrospectively document this attempted attack. The version information and download...

amadeus (>=0.3.5 <=0.4.3), amadeus-parquet (>=0.3.5 <=0.4.3) +103 more potentially affected by unknown CVE via fehler (=1.0.0)

fehler CARGO version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fehler and may be impacted: - amadeus =0.3.5, =0.3.5, =0.9.0, =0.9.0, =1.0.0, =0.0.2, =0.7.0, =0.5.0, =0.1.0, =0.2.0, =0.1.0, =0.2.0, =0.3.2 and more Source cves: unknown CVE...

acct (>=0.2.0 <=0.5.0), acid-store (>=0.8.0 <=0.14.2) +278 more potentially affected by unknown CVE via users (>=0.10.0 <=0.9.1)

users CARGO version =0.10.0, =0.2.0, =0.8.0, =0.4.0, =4.1.0, =0.1.0, =1.0.0, =0.1.0, =0.9.0, =0.9.0, =0.1.0, =0.6.2, =0.9.0, =0.2.4, =0.1.0, =0.4.51 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0059...

feembox (>=0.1.0 <=0.1.1), mail (>=0.6.0 <=0.7.0) +5 more potentially affected by unknown CVE via mail-internals (=0.2.3)

mail-internals CARGO version =0.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on mail-internals and may be impacted: - feembox =0.1.0, =0.6.0, =0.6.0, =0.6.0, =0.2.0, =0.6.0, =0.1.0, =0.1.2 Source cves: unknown CVE Source advisory:...

acct (>=0.2.0 <=0.5.0), acid-store (>=0.8.0 <=0.14.2) +278 more potentially affected by unknown CVE via users (>=0.10.0 <=0.9.1)

users CARGO version =0.10.0, =0.2.0, =0.8.0, =0.4.0, =4.1.0, =0.1.0, =1.0.0, =0.1.0, =0.9.0, =0.9.0, =0.1.0, =0.6.2, =0.9.0, =0.2.4, =0.1.0, =0.4.51 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0040...

aries-askar (>=0.1.2 <=0.2.7), arkworks-r1cs-gadgets (>=0.5.0 <=1.2.0) +106 more potentially affected by unknown CVE via xsalsa20poly1305 (>=0.4.2 <=0.9.1)

xsalsa20poly1305 CARGO version =0.4.2, =0.1.2, =0.5.0, =0.5.0, =0.2.0, =0.1.0, =0.1.0, =0.1.1 - bramble-handshake =0.1.0 - bramble-qr =0.1.0 - bramble-rendezvous =0.1.0 - bramble-sync =0.1.0 - bramble-transport =0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0037...

LicenseStore (=0.1.0), NT-anchor-lang (=0.19.0) +943 more potentially affected by unknown CVE via borsh (>=0.2.10 <=0.9.3)

borsh CARGO version =0.2.10, =0.19.0, =0.4.1, =0.1.0, =0.1.0, =1.0.5, =0.0.1, =0.0.1, =0.0.0-alpha, =0.0.1, =0.0.1-alpha.5 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0033...

BeerHolderBot (>=0.1.0 <=0.3.6), IMAPServer (>=0.1.0 <=0.2.0) +4841 more potentially affected by unknown CVE via tokio (>=0.2.10 <=1.17.0)

tokio CARGO version =0.2.10, =0.1.0, =0.1.0, =1.0.0, =0.0.2, =0.5.0, =0.1.0, =0.1.0, =0.1.0, =0.4.0, =0.5.0, =0.5.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0005...

ehsm (>=0.1.0 <=0.1.1), ic-identity-hsm (>=0.2.0 <=0.23.2) +4 more potentially affected by unknown CVE via pkcs11 (=0.5.0)

pkcs11 CARGO version =0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pkcs11 and may be impacted: - ehsm =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.0.1, =0.2.1 - tpm-change-pin =0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0034...

apollo-gateway-rs (>=0.7.5 <=0.7.6), aqlgen (>=0.1.0 <=0.8.0) +61 more potentially affected by unknown CVE via async-graphql (>=1.13.4 <=4.0.16)

async-graphql CARGO version =1.13.4, =0.7.5, =0.1.0, =0.1.0, =0.1.0, =0.0.1-alpha+3, =0.1.0, =2.9.13, =0.1.0-beta.0, =2.9.12, =0.2.0, =1.14.10, =0.1.0, =1.0.0, =4.0.16 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0037...

a2 (>=0.3.6 <=0.5.0-alpha.7), abci-rs (=0.2.0) +950 more potentially affected by unknown CVE via crossbeam-channel (>=0.1.3 <=0.3.9)

crossbeam-channel CARGO version =0.1.3, =0.3.6, =0.4.0, =0.5.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.2.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0019...

roaring-landmask (=0.4.0) potentially affected by CVE-2022-1343 via openssl-src (=300.0.0+3.0.0)

openssl-src CARGO version =300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask =0.4.0 Source cves: CVE-2022-1343 Source advisory: OSV:RUSTSEC-2022-0027...

wasmtime-cli (>=0.34.0 <=0.34.1) potentially affected by CVE-2022-24791 via wasmtime (>=0.34.0 <=0.34.1)

wasmtime CARGO version =0.34.0, =0.34.0, =0.34.1 Source cves: CVE-2022-24791 Source advisory: OSV:RUSTSEC-2022-0016...

deno (>=0.35.0 <=1.3.0), diss (>=0.0.1 <=0.2.10) +8 more potentially affected by unknown CVE via pty (>=0.1.6 <=0.2.2)

pty CARGO version =0.1.6, =0.35.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.0.0, =0.1.0 - webterm-rs =0.1.4 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0015...