167 matches found
Design/Logic Flaw
Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle MITM attacks. This vulnerability has been assigned...
CVE-2022-46176 Cargo did not verify SSH host keys
Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle MITM attacks. This vulnerability has been assigned...
AZL-35235 CVE-2022-35256 affecting package rust for versions less than 1.75.0-1
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling...
GHSA-QQFF-4VW4-F6HX Cap'n Proto and its Rust implementation vulnerable to out-of-bounds read due to logic error handling list-of-list
The Cap'n Proto library and capnp Rust package are vulnerable to out-of-bounds read due to logic error handling list-of-list. If a message consumer expects data of type "list of pointers", and if the consumer performs certain specific actions on such data, then a message producer can cause the...
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : rust1.62 (SUSE-SU-2022:3451-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3451-1 advisory. - CVE-2022-36113: Fixed symlink hijack vulnerability bsc1203433. - CVE-2022-36114: Fixed zip bom...
CVE-2022-36113 Extracting malicious crates can corrupt arbitrary files
Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the /.cargo folder on disk, making it available to the Rust projects it builds. To record when an extraction is successful, Cargo writes "ok" to the .cargo-ok file at the...
AZL-41446 CVE-2022-32215 affecting package rust for versions less than 1.75.0-1
The llhttp parser v14.20.1, v16.17.1 and v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling HRS...
AZL-40893 CVE-2022-32214 affecting package rust for versions less than 1.75.0-1
The llhttp parser v14.20.1, v16.17.1 and v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS...
AZL-41093 CVE-2022-1201 affecting package rust for versions less than 1.75.0-1
NULL Pointer Dereference in mrbvmexec with super in GitHub repository mruby/mruby prior to 3.2. This vulnerability is capable of making the mruby interpreter crash, thus affecting the availability of the system...
CVE-2020-36318 affecting package rust 1.47.0-2
CVE-2020-36318 affecting package rust 1.47.0-2. An upgraded version of the package is available that resolves this issue...
AZL-41766 CVE-2022-0890 affecting package rust for versions less than 1.75.0-1
NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2...
AZL-41314 CVE-2022-0632 affecting package rust for versions less than 1.75.0-1
NULL Pointer Dereference in Homebrew mruby prior to 3.2...
Mageia: Security Advisory (MGASA-2022-0044)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Photon OS 3.0: Rust PHSA-2021-3.0-0324
An update of the rust package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0324. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descriptio...
Critical Photon OS Security Update - PHSA-2021-0122
Updates of 'rust' packages of Photon OS have been released...
kea (>=0.1.0, <=0.1.3) potentially affected by CVE-2020-35885 via alpm-rs (0.1.24)
alpm-rs CARGO version 0.1.24 is affected by a known vulnerability. The following packages have a transitive dependency on alpm-rs and may be impacted: - kea =0.1.0, =0.1.3 Source cves: CVE-2020-35885 Source advisory: OSV:GHSA-QC4M-GC8R-MG8M...
azure-functions (>=0.1.1, <=0.2.1), azure-functions-shared (0.2.2) +17 more potentially affected by CVE-2019-15544 via protobuf (>=2.0.2, <=2.5.0)
protobuf CARGO version =2.0.2, =0.1.1, =0.3.0, =0.4.0, =0.1.0, =0.3.0, =0.3.0, =0.3.0, =2.0.2, =2.0.2, =0.2.0, =2.0.2, =2.5.0 - protoc-rust-no-elision 2.0.4 and more Source cves: CVE-2019-15544 Source advisory: OSV:GHSA-MH6H-F25P-98F8...
Photon OS 3.0: Rust PHSA-2021-3.0-0288
An update of the rust package has been released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0288. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc...
SUSE: Security Advisory (SUSE-SU-2018:3357-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
