CVE-2022-46176 Cargo did not verify SSH host keys

Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle MITM attacks. This vulnerability has been assigned...

CVE-2022-46176 Cargo did not verify SSH host keys

Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle MITM attacks. This vulnerability has been assigned...

CVE-2022-46176 Cargo did not verify SSH host keys

Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle MITM attacks. This vulnerability has been assigned...

CVE-2022-46176

Cargo for Rust did not verify SSH host keys when cloning indexes/dependencies via SSH, enabling potential MITM attacks. All Rust versions containing Cargo before 1.66.1 are affected; upgrading to Cargo/Rust 1.66.1 fixes the SSH host key verification behavior by aborting connections if the server ...

a2 (>=0.5.0-alpha.1, <=0.5.3), aahc (0.1.0) +4871 more potentially affected by unknown CVE via tokio (>=0.2.0-alpha.1, <=1.18.2)

tokio CARGO version =0.2.0-alpha.1, =0.5.0-alpha.1, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.5.0, =0.1.0, =0.1.0, =0.0.1, =0.0.7-alpha.3, =0.0.7-alpha.2, =0.0.7-alpha.1, =0.0.7-alpha.3, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0005...

deno_bench_util (>=0.73.0, <=0.79.0), deno_broadcast_channel (>=0.73.0, <=0.79.0) +37 more potentially affected by unknown CVE via tokio (>=1.21.1, <=1.24.0)

tokio CARGO version =1.21.1, =0.73.0, =0.73.0, =0.11.0, =0.161.0, =0.93.0, =0.102.0, =0.66.0, =0.15.0, =0.73.0, =0.71.0, =0.87.0, =0.79.0, =0.110.0, =0.80.0, =0.86.0 - denowebidl 0.85.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0005...

RUSTSEC-2023-0005 `tokio::io::ReadHalf<T>::unsplit` is Unsound

tokio::io::ReadHalf::unsplit can violate the Pin contract The soundness issue is described in the tokio/issues5372 Specific set of conditions needed to trigger an issue a !Unpin type in ReadHalf is unusual, combined with the difficulty of making any arbitrary use-after-free exploitable in Rust...

askai (0.1.0), doh-client (3.1.2) +25 more potentially affected by unknown CVE via tokio (>=1.19.2, <=1.20.1)

tokio CARGO version =1.19.2, =2.3.0, =4.1.2, =1.4.0, =1.18.1, =0.2.0, =0.16.0, =0.16.0, =0.16.0, =0.16.0, =0.16.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0005...

`tokio::io::ReadHalf<T>::unsplit` is Unsound

tokio::io::ReadHalf::unsplit can violate the Pin contract The soundness issue is described in the tokio/issues5372 Specific set of conditions needed to trigger an issue a !Unpin type in ReadHalf is unusual, combined with the difficulty of making any arbitrary use-after-free exploitable in Rust...

CVE-2022-46176

Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle MITM attacks. This vulnerability has been assigned...

GHSA-R5W3-XM58-JV6J Cargo did not verify SSH host keys

The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle MITM attacks. This vulnerability has been assigned CVE-2022-46176. Overview When an SSH client...

Cargo did not verify SSH host keys

The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle MITM attacks. This vulnerability has been assigned CVE-2022-46176. Overview When an SSH client...

armory_cli (>=0.3.3, <=0.3.28), armory_lib (>=0.1.0, <=0.3.28) +137 more potentially affected by CVE-2022-46176 via cargo (>=0.4.0, <=0.66.0)

cargo CARGO version =0.4.0, =0.3.3, =0.1.0, =0.10.0, =0.10.0, =0.1.0, =0.3.1, =0.0.1, =0.1.0, =0.1.0, =0.2.2, =0.6.0, =0.1.0, =0.1.2 and more Source cves: CVE-2022-46176 Source advisory: OSV:GHSA-R5W3-XM58-JV6J...

a2s (>=0.1.0, <=0.5.1), abxml (>=0.5.0, <=0.6.2) +227 more potentially affected by CVE-2023-22895 via bzip2 (>=0.2.3, <=0.3.3)

bzip2 CARGO version =0.2.3, =0.1.0, =0.5.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0-alpha.6, =0.1.3, =0.1.0, =0.1.0, =0.3.0, =2020.5.26, =0.1.0, =0.2.0, =1.0.0 and more Source cves: CVE-2023-22895 Source advisory: OSV:GHSA-96JV-R488-C2RJ...

bzip2 allows attackers to cause a denial of service via a large file that triggers an integer overflow

The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product...

CVE-2023-22895

The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product...

DEBIAN-CVE-2023-22895

The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product...

CVE-2023-22895

The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product...

UBUNTU-CVE-2023-22895

The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product...

PT-2023-1358

Name of the Vulnerable Software and Affected Versions Rust versions prior to 1.66.1 Description The issue is related to the Cargo package manager in Rust, which does not perform SSH host key verification when cloning indexes and dependencies via SSH. This allows an attacker to perform...