bottlerocket dependency openssl has a double free vulnerability

A timing based side channel exists in the OpenSSL RSA decryption implementation which could enable a recovery of plaintext from across the network. This affects all RSA padding modes. A server agent compiled with OpenSSL could be made to give up plaintext payloads over the network, but this would...

GHSA-J859-PMRQ-9Q6C bottlerocket dependency openssl has a double free vulnerability

A timing based side channel exists in the OpenSSL RSA decryption implementation which could enable a recovery of plaintext from across the network. This affects all RSA padding modes. A server agent compiled with OpenSSL could be made to give up plaintext payloads over the network, but this would...

bottlerocket dependency openssl is vulnerable to read buffer overflow via X.509 verification

A read buffer overflow can be triggered in OpenSSL X.509 verification during name constraint checking. Note that this occurs after the certificate chain has been verified and would require a compromised CA. This can cause a client or agent compiled with OpenSSL to crash unexpectedly. OpenSSL has...

arsdk-rs (>=0.0.2, <=0.0.5), burritun (>=0.1.0, <=0.1.1) +41 more potentially affected by unknown CVE via pnet_packet (>=0.20.0, <=0.26.0)

pnetpacket CARGO version =0.20.0, =0.0.2, =0.1.0, =1.3.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.6, =0.0.1, =0.3.0, =0.5.1 - jumpingsumo-rs 0.0.2 - kipa 0.1.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-CF4G-FCF8-3CR9...

GHSA-J79X-VVGM-W73W bottlerocket dependency openssl provides streaming of ASN.1 data via a BIO

An OpenSSL public API provides streaming of ASN.1 data via a BIO. It is possible for a malicious third party to use the BIO to access unfreed memory pointers that are not cleaned up after execution of the API. Freeing these memory pointers will result in a crash. Agents and clients compiled with...

accesskit_consumer (>=0.1.0, <=0.7.1), accesskit_windows (>=0.1.0, <=0.8.0) +658 more potentially affected by unknown CVE via im (>=9.0.0, <=15.1.0)

im CARGO version =9.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.5, =0.0.1, =0.0.1, =0.1.0, =0.0.1, =0.1.0, =1.15.0, =1.15.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0126...

New Wave of Ransomware Attacks Exploiting VMware Bug to Target ESXi Servers

VMware ESXi hypervisors are the target of a new wave of attacks designed to deploy ransomware on compromised systems. "These attack campaigns appear to exploit CVE-2021-21974, for which a patch has been available since February 23, 2021," the Computer Emergency Response Team CERT of France said i...

New Wave of Ransomware Attacks Exploiting VMware Bug to Target ESXi Servers

VMware ESXi hypervisors are the target of a new wave of attacks designed to deploy ransomware on compromised systems. "These attack campaigns appear to exploit CVE-2021-21974, for which a patch has been available since February 23, 2021," the Computer Emergency Response Team CERT of France said i...

GHSA-4Q83-7CQ4-P6WG `tokio::io::ReadHalf<T>::unsplit` is Unsound

tokio::io::ReadHalf::unsplit can violate the Pin contract The soundness issue is described in the tokio/issues5372 Specific set of conditions needed to trigger an issue a !Unpin type in ReadHalf is unusual, combined with the difficulty of making any arbitrary use-after-free exploitable in Rust...

[SECURITY] Fedora 36 Update: rust-tokei-12.1.2-4.fc36

Count your code, quickly...

[SECURITY] Fedora 36 Update: rust-silver-2.0.1-4.fc36

Cross-shell customizable powerline-like prompt with icons...

[SECURITY] Fedora 36 Update: rust-resctl-bench-2.1.2-8.fc36

resctl-bench is a collection of whole-system benchmarks to evaluate resource control and hardware behaviors using realistic simulated workloads. Comprehensive resource control involves the whole system. Furthermore, testing resource control end-to-end requires scenarios involving realistic...

[SECURITY] Fedora 36 Update: rust-rd-hashd-2.1.2-7.fc36

Latency-sensitive pseudo workload for resctl-demo...

[SECURITY] Fedora 36 Update: rust-pretty-git-prompt-0.2.1-15.fc36

Your current git repository information inside a beautiful shell prompt...

[SECURITY] Fedora 36 Update: rust-pore-0.1.8-2.fc36

Performance oriented reimplementation of repo...

[SECURITY] Fedora 36 Update: rust-gitui-0.20.1-6.fc36

Blazing fast terminal-ui for git...

[SECURITY] Fedora 36 Update: rust-exa-0.10.1-9.fc36

exa is a modern replacement for the command-line program ls that ships with Unix and Linux operating systems, with more features and better defaults. It uses colours to distinguish file types and metadata. It knows about symlinks, extended attributes, and Git. And it=EF=BF=BD=EF=BF =BD=EF=BF=BDs...

[SECURITY] Fedora 36 Update: rust-cargo-c-0.9.12-3.fc36

Helper program to build and install c-like libraries...

[SECURITY] Fedora 36 Update: rust-bat-0.21.0-6.fc36

Cat1 clone with wings...

Fedora: Security Advisory for rust-tokei (FEDORA-2023-3ec32f6d4e)

The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...