bump (0.0.0), resufancy (>=0.1.0, <=0.1.1) potentially affected by unknown CVE via filesystem (0.4.4)

filesystem CARGO version 0.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on filesystem and may be impacted: - bump 0.0.0 - resufancy =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0015...

oniguruma: Use-after-free in onig_new_deluxe() in regext.c

A use-after-free in onignewdeluxe in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte...

objstor (>=0.4.6, <=0.4.20), rblog (>=0.100.0, <=0.123.0) +12 more potentially affected by CVE-2024-23644 via trillium-http (>=0.2.14, <=0.3.3)

trillium-http CARGO version =0.2.14, =0.4.6, =0.100.0, =0.2.0, =0.2.0-rc.1, =0.2.0, =0.2.0, =0.2.0, =0.3.0, =0.2.0, =0.3.1, =0.4.2 - trillium-tracing 0.1.0 Source cves: CVE-2024-23644 Source advisory: OSV:GHSA-9F9P-CP3C-72JF...

objstor (>=0.4.6, <=0.4.20), trillium-html-rewriter (0.3.0) +1 more potentially affected by CVE-2024-23644 via trillium-client (>=0.2.2, <=0.4.9)

trillium-client CARGO version =0.2.2, =0.4.6, =0.2.0, =0.5.0 Source cves: CVE-2024-23644 Source advisory: OSV:GHSA-9F9P-CP3C-72JF...

CVE-2024-23644

Trillium is a composable toolkit for building internet applications with async rust. In trillium-http prior to 0.3.12 and trillium-client prior to 0.5.4, insufficient validation of outbound header values may lead to request splitting or response splitting attacks in scenarios where attackers have...

CVE-2024-23644 trillium-http and trillium-client vulnerable to HTTP Request/Response Splitting

Trillium is a composable toolkit for building internet applications with async rust. In trillium-http prior to 0.3.12 and trillium-client prior to 0.5.4, insufficient validation of outbound header values may lead to request splitting or response splitting attacks in scenarios where attackers have...

CVE-2024-23644

CVE-2024-23644 affects Trillium, specifically the crates trillium-http (versions prior to 0.3.12) and trillium-client (prior to 0.5.4). The issue is improper validation of outbound header values and names, where header values/names can be constructed infallibly and may contain illegal bytes. If a...

anchor-token (>=0.0.1, <=0.3.0), archid-token (>=1.0.0, <=1.0.2) +138 more potentially affected by CVE-2024-58264 via serde-json-wasm (>=0.1.3, <=0.4.1)

serde-json-wasm CARGO version =0.1.3, =0.0.1, =1.0.0, =0.3.1, =0.1.0, =0.1.0, =0.4.0, =1.0.0, =0.1.1, =0.13.2, =0.8.0-alpha1, =0.8.0-alpha1, =0.16.7 and more Source cves: CVE-2024-58264 Source advisory: OSV:RUSTSEC-2024-0012...

RHCOS 4 : OpenShift Container Platform 4.12.9 (RHSA-2023:1408)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:1408 advisory. - capnproto: out of bounds read when handling a list of lists. CVE-2022-46149 Note that Nessus has not tested for this issue but has instead...

objstor (>=0.4.6, <=0.4.20), rblog (>=0.100.0, <=0.123.0) +12 more potentially affected by CVE-2024-23644 via trillium-http (>=0.2.14, <=0.3.3)

trillium-http CARGO version =0.2.14, =0.4.6, =0.100.0, =0.2.0, =0.2.0-rc.1, =0.2.0, =0.2.0, =0.2.0, =0.3.0, =0.2.0, =0.3.1, =0.4.2 - trillium-tracing 0.1.0 Source cves: CVE-2024-23644 Source advisory: OSV:RUSTSEC-2024-0009...

objstor (>=0.4.6, <=0.4.20), trillium-html-rewriter (0.3.0) +1 more potentially affected by CVE-2024-23644 via trillium-client (>=0.2.2, <=0.4.9)

trillium-client CARGO version =0.2.2, =0.4.6, =0.2.0, =0.5.0 Source cves: CVE-2024-23644 Source advisory: OSV:RUSTSEC-2024-0008...

Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2024-497)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-497 advisory. Cargo downloads a Rust project's dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by...

Amazon Linux 2 : rust (ALAS-2024-2426)

The version of rust installed on the remote host is prior to 1.68.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2426 advisory. Cargo downloads a Rust project's dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not esca...

Coldriver threat group targets high-ranking officials to obtain credentials

Researchers at Google’s Threat Analysis Group TAG have published their findings about a group they have dubbed Coldriver. The main targets of the Coldriver group are high-profile individuals in non-governmental organizations NGOs, former intelligence and military officials, and NATO governments...

COLDRIVER Expands Beyond Phishing, Incorporating Custom SPICA Backdoor

Summary: The threat actor associated with Russia, known as COLDRIVER or Star Blizard, has expanded its tactics from mere credential harvesting. The group has initiated campaigns where PDFs are employed as lure documents to distribute malware. Notably, COLDRIVER has introduced its first custom...

Medium: rust

Issue Overview: Cargo downloads a Rust project's dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject...

Medium: rust

Issue Overview: Cargo downloads a Rust project's dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject...

Medium: rust

Issue Overview: Cargo downloads a Rust project's dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject...

Medium: rust

Issue Overview: Cargo downloads a Rust project's dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject...

lillinput (>=0.2.1, <=0.3.0), lillinput-cli (0.3.0) potentially affected by CVE-2024-58266 via shlex (1.1.0)

shlex CARGO version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on shlex and may be impacted: - lillinput =0.2.1, =0.3.0 - lillinput-cli 0.3.0 Source cves: CVE-2024-58266 Source advisory: OSV:RUSTSEC-2024-0006...