Memory leak when calling a canister method via `ic_cdk::call`

When a canister method is called via iccdk::call, a new Future CallFuture is created and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called CallFutureState. A bug in the polling implementation of the CallFuture...

RUSTSEC-2024-0372 Memory leak when calling a canister method via `ic_cdk::call`

When a canister method is called via iccdk::call, a new Future CallFuture is created and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called CallFutureState. A bug in the polling implementation of the CallFuture...

Rust Canister Development Kit 安全漏洞

Rust Canister Development Kit is a DFINITY open source Rust development kit for Internet computers. A security vulnerability exists in the Rust Canister Development Kit, which is caused by a memory leak where not all references are removed before resolving the Future...

PT-2024-38658 · Ic Cdk · Ic Cdk

Name of the Vulnerable Software and Affected Versions: ic cdk versions 0.8.0 through 0.15.0 Description: A bug in the polling implementation of the CallFuture allows multiple references to be held for the internal state and not all references were dropped before the Future is resolved, causing a...

CVE-2024-43402

Rust is a programming language. The fix for CVE-2024-24576, where std::process::Command incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix when the batch file name had trailing whitespace or periods...

CVE-2024-43402

Rust is a programming language. The fix for CVE-2024-24576, where std::process::Command incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix when the batch file name had trailing whitespace or periods...

CVE-2024-43402 Rust OS Command Injection/Argument Injection vulnerability

Rust is a programming language. The fix for CVE-2024-24576, where std::process::Command incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix when the batch file name had trailing whitespace or periods...

CVE-2024-43402

Rust is a programming language. The fix for CVE-2024-24576, where std::process::Command incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix when the batch file name had trailing whitespace or periods...

CVE-2024-43402 Rust OS Command Injection/Argument Injection vulnerability

Rust is a programming language. The fix for CVE-2024-24576, where std::process::Command incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix when the batch file name had trailing whitespace or periods...

CVE-2024-43402

Rust is a programming language. The fix for CVE-2024-24576, where std::process::Command incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix when the batch file name had trailing whitespace or periods...

CVE-2024-43402

CVE-2024-43402 describes a Rust vulnerability in how Windows batch file names with trailing spaces or periods could bypass the existing mitigation for CVE-2024-24576. The issue arises from how the original fix checked for .bat/.cmd endings, failing to account for Windows normalizing trailing whit...

CVE-2024-43402 Rust OS Command Injection/Argument Injection vulnerability

Rust is a programming language. The fix for CVE-2024-24576, where std::process::Command incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix when the batch file name had trailing whitespace or periods...

foxear (0.1.0), pressurize (>=0.0.1, <=0.1.0) potentially affected by unknown CVE via bcc (>=0.0.31, <=0.0.32)

bcc CARGO version =0.0.31, =0.0.1, =0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0383...

aquatic_common (0.2.0), core-allocator (>=0.1.0, <=0.1.6) +16 more potentially affected by unknown CVE via hwloc (>=0.3.0, <=0.5.0)

hwloc CARGO version =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =2.0.0, =0.1.6, =5.0.0, =5.0.0, =0.1.1, =0.11.0, =5.0.0, =6.0.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0382...

bitcoin (>=0.4.2, <=0.18.2), bitcoin-amount (>=0.1.3, <=0.1.4) +23 more potentially affected by unknown CVE via strason (>=0.3.4, <=0.4.0)

strason CARGO version =0.3.4, =0.4.2, =0.1.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0386...

Rust 安全漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation in the United States. A security vulnerability exists in versions of Rust prior to 1.81.0 that stems from a fix that can be bypassed when a batch file name has trailing spaces or periods...

GHSA-P2Q9-36VW-C468 olm-sys: wrapped library unmaintained, potentially vulnerable

After several cryptographic vulnerabilities in libolm were disclosed publicly, the Matrix Foundation has officially deprecated the library. olm-sys is a thin wrapper around libolm and is now deprecated and potentially vulnerable in kind. Users of olm-sys and its higher-level abstraction, olm-rs,...

olm-sys: wrapped library unmaintained, potentially vulnerable

After several cryptographic vulnerabilities in libolm were disclosed publicly, the Matrix Foundation has officially deprecated the library. olm-sys is a thin wrapper around libolm and is now deprecated and potentially vulnerable in kind. Users of olm-sys and its higher-level abstraction, olm-rs,...

alerter (>=0.3.0, <=0.3.1), maruc (0.1.0) +8 more potentially affected by unknown CVE via olm-sys (1.3.2)

olm-sys CARGO version 1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on olm-sys and may be impacted: - alerter =0.3.0, =0.2.0, =0.3.0, =0.1.0, =0.2.0, =0.1.0, =1.0.0, =0.13.0, =0.1.0, =0.4.0 Source cves: unknown CVE Source advisory:...

New Rust-Based Ransomware Cicada3301 Targets Windows and Linux Systems

Cybersecurity researchers have unpacked the inner workings of a new ransomware variant called Cicada3301 that shares similarities with the now-defunct BlackCat aka ALPHV operation. "It appears that Cicada3301 ransomware primarily targets small to medium-sized businesses SMBs, likely through...