bsv-wasm (>=0.0.0 <=1.2.0-beta.3), cargo-screeps (>=0.3.3 <=0.4.0) +11 more potentially affected by unknown CVE via openssl (>=0.10.22 <=0.10.40)

openssl CARGO version =0.10.22, =0.0.0, =0.3.3, =0.6.25, =0.1.24, =0.1.22, =0.1.24, =0.1.0, =0.10.4, =0.10.3, =0.21.0 - roaring-landmask =0.4.0 - twetch-sdk =0.0.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0022...

bsv-wasm (>=0.0.0 <=1.2.0-beta.3), cargo-screeps (>=0.3.3 <=0.4.0) +11 more potentially affected by unknown CVE via openssl (>=0.10.22 <=0.10.40)

openssl CARGO version =0.10.22, =0.0.0, =0.3.3, =0.6.25, =0.1.24, =0.1.22, =0.1.24, =0.1.0, =0.10.4, =0.10.3, =0.21.0 - roaring-landmask =0.4.0 - twetch-sdk =0.0.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0024...

CVE-2023-28113 russh may use insecure Diffie-Hellman keys

russh is a Rust SSH client and server library. Starting in version 0.34.0 and prior to versions 0.36.2 and 0.37.1, Diffie-Hellman key validation is insufficient, which can lead to insecure shared secrets and therefore breaks confidentiality. Connections between a russh client and server or those ...

annatar (=0.6.1), aoer-plotty-rs (>=0.2.1 <=0.4.1) +118 more potentially affected by unknown CVE via const-cstr (>=0.1.0 <=0.3.0)

const-cstr CARGO version =0.1.0, =0.2.1, =0.3.6, =0.5.0, =0.1.0, =0.1.0, =0.11.0+8.3.2, =0.0.1, =1.0.0, =1.3.3 - capsicum =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0020...

cacheline-ef (>=1.0.0 <=1.1.0), dsi-bitstream (=0.4.2) +7 more potentially affected by unknown CVE via maligned (=0.2.1)

maligned CARGO version =0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on maligned and may be impacted: - cacheline-ef =1.0.0, =0.4.0, =0.6.0, =0.1.6, =0.1.0, =0.4.0, =0.4.2 - vframe =0.3.2 Source cves: unknown CVE Source advisory:...

openssl-sys (>=0.9.35 <=0.9.37) potentially affected by CVE-2022-4304 via openssl-src (=110.0.7+1.1.0i)

openssl-src CARGO version =110.0.7+1.1.0i is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - openssl-sys =0.9.35, =0.9.37 Source cves: CVE-2022-4304 Source advisory: OSV:RUSTSEC-2023-0007...

roaring-landmask (=0.4.0) potentially affected by CVE-2023-0216 via openssl-src (=300.0.0+3.0.0)

openssl-src CARGO version =300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask =0.4.0 Source cves: CVE-2023-0216 Source advisory: OSV:RUSTSEC-2023-0011...

cargo-travis (>=0.0.10 <=0.0.11), cargo-travis-fork (>=0.0.11 <=0.0.12) potentially affected by unknown CVE via badge (>=0.2.0 <=0.3.0)

badge CARGO version =0.2.0, =0.0.10, =0.0.11, =0.0.12 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0057...

AsgoreCore (>=0.1.0 <=0.1.2), RustyBox (=0.1.0) +210 more potentially affected by unknown CVE via clipboard (>=0.1.2 <=0.5.0)

clipboard CARGO version =0.1.2, =0.1.0, =0.1.0, =0.6.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.8.0, =0.3.0, =0.4.0, =0.8.0, =0.15.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0056...

novel (=0.4.2), salvo (>=0.1.5 <=0.1.6) +4 more potentially affected by unknown CVE via double-checked-cell (>=1.1.0 <=2.1.0)

double-checked-cell CARGO version =1.1.0, =0.1.5, =0.1.5, =0.1.5, =0.1.0, =1.0.0, =1.0.4-beta-2 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0024...

malicious crate `rustdecimal`

The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained malware. The crate name was intentionally similar to the name of the popular rustdecimal2 crate, hoping that potential victims would misspell its...

auto-wasi (=0.1.0), ceres-executor (>=0.1.0 <=0.2.0) +47 more potentially affected by CVE-2022-24791 via wasmtime (>=0.10.0 <=0.34.1)

wasmtime CARGO version =0.10.0, =0.1.0, =0.0.0, =0.40.1, =0.45.0, =0.1.0, =0.1.0, =0.1.0, =0.3.3, =0.1.0, =0.8.0, =0.8.0, =0.9.0 and more Source cves: CVE-2022-24791 Source advisory: OSV:RUSTSEC-2022-0099...

SUSE-SU-2022:0843-1 Security update for rust, rust1.58, rust1.59

This update for rust, rust1.58, rust1.59 fixes the following issues: This update provides both rust1.58 and rust1.59. Changes in rust1.58: - Add recommends for GCC for installs to be able to link. - Add suggests for lld/clang which are faster than gcc for linking to allow users choice on what the...

SUSE-SU-2022:0491-1 Security update for rust

This update for rust fixes the following issues: - CVE-2022-21658: Fixed race condition in std::fs::removedirall bsc1194767...

SUSE-SU-2022:0200-1 Security update for rust

This update for rust fixes the following issues: - CVE-2022-21658: Fixed race condition in std::fs::removedirall bsc1194767...

SUSE-SU-2022:0149-1 Security update for rust1.56

This update for rust1.56 fixes the following issues: - CVE-2022-21658: Fixed race condition in std::fs::removedirall bsc1194767...

acme-dns-rust (>=1.0.0 <=1.0.6), acme2-slim (=0.2.0) +161 more potentially affected by unknown CVE via warp (>=0.1.23 <=0.3.1)

warp CARGO version =0.1.23, =1.0.0, =0.1.0, =0.1.0, =0.1.5, =0.1.0, =1.0.0, =0.14.0, =0.4.0, =0.1.0, =0.1.0, =0.1.6 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0082...

afterglow (>=0.1.0 <=0.3.0), aiid_js (=0.0.1) +47 more potentially affected by unknown CVE via bumpalo (=2.6.0)

bumpalo CARGO version =2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on bumpalo and may be impacted: - afterglow =0.1.0, =0.5.4, =0.1.0, =3.0.0, =4.0.2, =0.114.0, =0.114.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.6.1 and more Source cves: unkno...

Memory corruption

An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot channel, there is a data race and memory corruption...

Rust 安全漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. a security vulnerability exists in versions of Rust nanorand crate prior to 0.6.1, which stems from the fact that the same object can have multiple mutable references. No details of the vulnerability are current...