CVE-2021-45698

An issue was discovered in the ckb crate before 0.40.0 for Rust. A getblocktemplate RPC call may fail in situations where it is supposed to select a Nervos CKB blockchain transaction with a higher fee rate than another transaction...

CVE-2021-45698

The CVE-2021-45698 issue affects the Rust crate ckb prior to 0.40.0. The get_block_template RPC may fail when it should select a higher-fee transaction, impacting block template construction. The vulnerability is described consistently across sources (NVD/Red Hat and related advisories) as a get_...

CVE-2021-45699

CVE-2021-45699 affects the Rust crate ckb (pre-0.40.0). The issue allows remote attackers to trigger an inability to allocate memory for the misbehavior HashMap, potentially enabling a 51% attack against the Nervos CKB blockchain. The root cause is memory management for the HashMap used to track ...

CVE-2021-45700

CVE-2021-45700 describes a DoS in the Rust-CKB crate (ckb) prior to version 0.40.0. The vulnerability allows an attacker to crash Nervos CKB blockchain nodes by triggering a dead call used as a DepGroup, leading to node instability or service disruption. Affected software: ckb crate before 0.40.0...

CVE-2021-45701

CVE-2021-45701 affects the tremor-script crate for Rust prior to 0.11.6, where a patch/merge operation could yield a use-after-free due to in-place optimization that reused memory from the event data. The vulnerability is described across multiple feeds (e.g., OSV entries for tremor-script and re...

CVE-2021-45701

An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A patch operation may result in a use-after-free...

CVE-2021-45702

The CVE-2021-45702 issue affects the tremor-script Rust crate prior to 0.11.6. A memory-safety flaw arises when performing a Merge or Patch and assigning the result back to the same state, where in-place optimization can leave references to data that has been freed. The root cause is the Value re...

CVE-2021-45703

The CVE-2021-45703 entry concerns the Rust crate tectonic_xdv (pre-0.1.12). The issue is that XdvParser::::process may read from uninitialized memory locations, which can lead to undefined behavior. Affected versions are before 0.1.12; the fixed version is 0.1.12. No exploit details are provided ...

CVE-2021-45704

An issue was discovered in the metrics-util crate before 0.7.0 for Rust. There is a data race and memory corruption because AtomicBucket unconditionally implements the Send and Sync traits...

CVE-2021-45704

CVE-2021-45704 affects the Rust metrics-util crate prior to 0.7.0. The issue is a data race and potential memory corruption caused by AtomicBucket unconditionally implementing Send/Sync, which allows concurrent access to inner data that may not be Sync. Public advisories (Red Hat, OSV, GitHub, CN...

CVE-2021-45705

An issue was discovered in the nanorand crate before 0.6.1 for Rust. There can be multiple mutable references to the same object because the TlsWyRand Deref implementation dereferences a raw pointer...

CVE-2021-45705

The CVE-2021-45705 entry affects the Rust nanorand crate, specifically versions before 0.6.1. The root cause is that the TlsWyRand Deref implementation dereferences a raw pointer, which can yield multiple mutable references to the same object and results in undefined behavior. Impact described in...

CVE-2021-45706

CVE-2021-45706 refers to a memory-zeroing flaw in the Rust crate zeroize_derive prior to version 1.1.1, where dropped memory for enum types is not zeroed. Public advisories (e.g., GHSA-C5HX-W945-J4PQ, RUSTSEC-2021-0115) confirm the issue affects enums when using #[zeroize(drop)]. The vulnerabilit...

CVE-2021-45707

An issue was discovered in the nix crate 0.16.0 and later before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2 for Rust. unistd::getgrouplist has an out-of-bounds write if a user is in more than 16 /etc/groups groups...

CVE-2021-45707

An issue was discovered in the nix crate 0.16.0 and later before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2 for Rust. unistd::getgrouplist has an out-of-bounds write if a user is in more than 16 /etc/groups groups...

CVE-2021-45707

CVE-2021-45707 affects the nix crate (Rust) versions 0.16.0 and later, with fixes in 0.20.2, 0.21.2, and 0.22.2 or later. The vulnerability is an out-of-bounds write in unistd::getgrouplist when a user belongs to more than 16 /etc/groups groups, which can lead to memory corruption. The issue stem...

CVE-2021-45708

An issue was discovered in the abomonation crate through 2021-10-17 for Rust. Because transmute operations are insufficiently constrained, there can be an information leak or ASLR bypass...

CVE-2021-45708

CVE-2021-45708 concerns the abomonation crate for Rust, where unconstrained transmute operations can leak information or bypass ASLR. The issue arises from the core use of transmute within abomonation’s serialization/deserialization paths and can affect alignment guarantees, potentially exposing ...

CVE-2021-45709

CVE-2021-45709 affects the crypto2 crate for Rust up to 2021-10-08, where during ChaCha20 encryption/decryption an unaligned read of a u32 may occur. Related sources (OSV/GHSA/RUSTSEC) describe the root cause as incorrect assumptions about 4-byte alignment in an unsafe slice::from_raw_parts_mut c...

CVE-2021-45709

An issue was discovered in the crypto2 crate through 2021-10-08 for Rust. During Chacha20 encryption and decryption, an unaligned read of a u32 may occur...