CVE-2024-27308

Mio is a Metal I/O library for Rust. When using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some...

Design/Logic Flaw

Mio is a Metal I/O library for Rust. When using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some...

CVE-2024-27308 Mio's tokens for named pipes may be delivered after deregistration

Mio is a Metal I/O library for Rust. When using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some...

CVE-2024-27308

CVE-2024-27308 affects the Mio Rust library (Windows named pipes). Vulnerable are Mio versions 0.7.2 through 0.8.10; fixed in 0.8.11. The issue is that, in certain cases, tokens for named pipes can refer to deregistered pipes, which can lead to use-after-free scenarios, especially if applications...

GHSA-CGQF-3CQ5-WVCJ Apollo Router's Compressed Payloads do not respect HTTP Payload Limits

Impact The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service DoS type vulnerability. When receiving compressed HTTP payloads, affected versions of the Route...

Apollo Router's Compressed Payloads do not respect HTTP Payload Limits

Impact The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service DoS type vulnerability. When receiving compressed HTTP payloads, affected versions of the Route...

inigo-rs (>=0.1.1, <=0.1.4) potentially affected by CVE-2024-28101 via apollo-router (1.6.0)

apollo-router CARGO version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on apollo-router and may be impacted: - inigo-rs =0.1.1, =0.1.4 Source cves: CVE-2024-28101 Source advisory: OSV:GHSA-CGQF-3CQ5-WVCJ...

*const c_void / ExternalPointer unsoundness leading to use-after-free

Summary Use of inherently unsafe const cvoid and ExternalPointer leads to use-after-free access of the underlying structure, resulting in arbitrary code execution. Details const cvoid and ExternalPointer defined via external! macros types are used to represent v8::External wrapping arbitrary void...

GHSA-3J27-563V-28WF *const c_void / ExternalPointer unsoundness leading to use-after-free

Summary Use of inherently unsafe const cvoid and ExternalPointer leads to use-after-free access of the underlying structure, resulting in arbitrary code execution. Details const cvoid and ExternalPointer defined via external! macros types are used to represent v8::External wrapping arbitrary void...

Mio Security Breach

Mio is the Metal I/O library for Rust. A security vulnerability exists in Mio versions v0.7.2 through prior to v0.8.11, which stems from the return of invalid tokens under certain circumstances, potentially leading to reuse after release...

vl-convert-rs (0.8.0) potentially affected by CVE-2024-27936 via deno_runtime (0.105.0)

denoruntime CARGO version 0.105.0 is affected by a known vulnerability. The following packages have a transitive dependency on denoruntime and may be impacted: - vl-convert-rs 0.8.0 Source cves: CVE-2024-27936 Source advisory: OSV:GHSA-M4PQ-FV2W-6HRW...

aide (>=0.1.0, <=0.4.3), bpxe (>=0.1.0, <=0.1.2) +66 more potentially affected by unknown CVE via linkme (>=0.1.6, <=0.2.10)

linkme CARGO version =0.1.6, =0.1.0, =0.1.0, =0.1.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2-alpha, =0.0.2-alpha, =0.0.4-alpha and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0407...

aaa (>=0.1.0, <=1.1.1), abbegm (0.5.0) +1502 more potentially affected by CVE-2024-27308 via mio (>=0.7.14, <=0.8.8)

mio CARGO version =0.7.14, =0.1.0, =2.0.0-beta.1, =0.9.0, =0.9.0, =0.1.0, =0.1.0, =0.1.0, =1.0.9, =1.0.11 and more Source cves: CVE-2024-27308 Source advisory: OSV:GHSA-R8W9-5WCG-VFJ7...

aaa (>=0.1.0, <=1.1.1), abbegm (0.5.0) +1502 more potentially affected by CVE-2024-27308 via mio (>=0.7.14, <=0.8.8)

mio CARGO version =0.7.14, =0.1.0, =2.0.0-beta.1, =0.9.0, =0.9.0, =0.1.0, =0.1.0, =0.1.0, =1.0.9, =1.0.11 and more Source cves: CVE-2024-27308 Source advisory: OSV:RUSTSEC-2024-0019...

aipster (>=1.0.0, <=2.0.0), aki-image-view-gtk (>=0.2.0, <=0.2.10) +398 more potentially affected by unknown CVE via gdk-sys (>=0.2.1, <=0.18.2)

gdk-sys CARGO version =0.2.1, =1.0.0, =0.2.0, =0.1.0, =0.0.1, =0.1.2, =0.1.0, =0.21.0, =0.30.1 - avr-vm 0.1.0 - awl 0.0.1 - bare-metrics-gui 0.1.0 - battery-savior 0.1.0 - bbfpromix 0.1.0 - beemovie-gui 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0418...

aipster (>=1.0.0, <=2.0.0), aki-image-view-gtk (>=0.2.0, <=0.2.10) +187 more potentially affected by unknown CVE via gtk3-macros (>=0.14.0, <=0.18.2)

gtk3-macros CARGO version =0.14.0, =1.0.0, =0.2.0, =0.1.0, =0.2.0-alpha, =0.29.2, =0.1.0, =0.1.0, =0.9.0, =0.1.0, =0.4.0, =0.7.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0419...

aipster (>=1.0.0, <=2.0.0), aki-image-view-gtk (>=0.2.0, <=0.2.10) +309 more potentially affected by unknown CVE via gdk (>=0.3.0, <=0.18.2)

gdk CARGO version =0.3.0, =1.0.0, =0.2.0, =0.1.0, =0.1.2, =0.1.0, =0.21.0, =0.1.0, =0.1.0, =0.1.0, =0.1.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0412...

aipster (>=1.0.0, <=2.0.0), aki-image-view-gtk (>=0.2.0, <=0.2.10) +397 more potentially affected by unknown CVE via atk-sys (>=0.3.4, <=0.18.2)

atk-sys CARGO version =0.3.4, =1.0.0, =0.2.0, =0.1.0, =0.0.1, =0.1.2, =0.2.0-alpha, =0.6.0, =0.21.0, =0.30.1 - avr-vm 0.1.0 - awl 0.0.1 - bare-metrics-gui 0.1.0 - battery-savior 0.1.0 - bbfpromix 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0416...

aipster (>=1.0.0, <=2.0.0), aki-image-view-gtk (>=0.2.0, <=0.2.10) +275 more potentially affected by unknown CVE via atk (>=0.8.0, <=0.18.2)

atk CARGO version =0.8.0, =1.0.0, =0.2.0, =0.1.0, =0.1.2, =0.2.0-alpha, =0.21.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0413...

ashpd (>=0.2.0-beta-1, <=0.4.0), browser_crate (0.1.0) +35 more potentially affected by unknown CVE via gdkwayland-sys (>=0.15.3, <=0.18.2)

gdkwayland-sys CARGO version =0.15.3, =0.2.0-beta-1, =0.4.0, =0.22.0, =0.22.0, =0.22.0, =0.15.0, =0.1.0, =0.4.0, =2.0.0-beta.0, =0.1.0, =0.1.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0411...