CVE-2022-39252: Key Exchange without Entity Authentication

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, when a user requests a room key from their devices, the software correctly remembers the request. When the user receives a forwarded room...

Denial Of Service (DoS)

binutils is vulnerable to denial of service. The vulnerability exists due to a flaw in demanglepath in rust-demangle.c allowing an attacker to crash the system by injecting a crafted symbol...

RUSTSEC-2022-0058 Library exclusively intended to inject UB into safe Rust.

Quoting from the crate description: This crate is created purely to inject undefined behavior into stable, safe rust. Specifically, the inconceivable! macro is insta-UB if the ubinconceivable feature is enabled by any reverse dependency. The value this adds is questionable, and hides unsafe code...

Library exclusively intended to inject UB into safe Rust.

Quoting from the crate description: This crate is created purely to inject undefined behavior into stable, safe rust. Specifically, the inconceivable! macro is insta-UB if the ubinconceivable feature is enabled by any reverse dependency. The value this adds is questionable, and hides unsafe code...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : oniguruma (SUSE-SU-2022:3327-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3327-1 advisory. - CVE-2019-19246: Fixed an out of bounds access during regular expression matching bsc1157805. -...

personnummer/rust vulnerable to Improper Input Validation

This vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure. The vulnerability is determined to be low severity. Impact This vulnerability impacts...

GHSA-28R9-PQ4C-WP3C personnummer/rust vulnerable to Improper Input Validation

This vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure. The vulnerability is determined to be low severity. Impact This vulnerability impacts...

GHSA-P75V-367R-2V23 `cell-project` used incorrect variance when projecting through `&Cell<T>`

Overview The issue lies in the implementation of the cellproject macro which used field as const instead of field as mut . The problem being that const T is covariant in T while mut T is invariant in T. Keep in mind that &Cell is invariant in T, so casting to const T relaxed the variance, and lea...

GHSA-V8GQ-5GRQ-9728 mozjpeg DecompressScanlines::read_scanlines is Unsound

This issue and vector is similar to RUSTSEC-2020-0029 of rgb crate which mozjpeg depends on. Affected versions of mozjpeg crate allow creating instances of any type T from bytes, and do not correctly constrain T to the types for which it is safe to do so. Examples of safety violation possible for...

alloc-cortex-m (>=0.1.0, <=0.4.2), bottleos (0.2.0) +23 more potentially affected by CVE-2022-36086 via linked_list_allocator (>=0.2.7, <=0.9.1)

linkedlistallocator CARGO version =0.2.7, =0.1.0, =0.1.0, =0.3.0, =0.4.0-pre, =0.4.0-pre, =0.1.0, =0.0.1, =0.3.2, =0.11.0, =0.1.0, =0.0.1, =0.1.0 and more Source cves: CVE-2022-36086 Source advisory: OSV:GHSA-XG8P-34W2-J49J...

GHSA-RC23-XXGQ-X27G wee_alloc is Unmaintained

Two of the maintainers have indicated that the crate may not be maintained. The crate has open issues including memory leaks and may not be suitable for production use. It may be best to switch to the default Rust standard allocator on wasm32 targets. Last release seems to have been three years a...

accrete (>=0.1.7, <=0.2.0), adana-script-wasm (>=0.16.5-rc.1, <=0.17.10) +270 more potentially affected by unknown CVE via wee_alloc (>=0.1.0, <=0.4.5)

weealloc CARGO version =0.1.0, =0.1.7, =0.16.5-rc.1, =0.1.0, =0.8.0, =0.1.1, =0.1.2, =1.4.0, =0.1.0, =0.1.0, =1.2.0-beta.4, =0.1.0, =0.9.3, =1.3.4 and more Source cves: unknown CVE Source advisory: OSV:GHSA-RC23-XXGQ-X27G...

accepted (>=0.2.0, <=0.3.1), aigc_keychain (5.1.2) +308 more potentially affected by unknown CVE via typemap (0.3.3)

typemap CARGO version 0.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on typemap and may be impacted: - accepted =0.2.0, =0.1.0, =0.2.0, =0.3.2, =0.0.1, =0.5.0, =0.1.3, =0.1.0, =0.0.1, =0.8.0 and more Source cves: unknown CVE Source advisory:...

GHSA-PP8R-VV2J-9J5V traitobject is Unmaintained

Crate traitobject has not had a release for over five years. In addition there is an existing security advisory that has not been addressed: - RUSTSEC-2020-0027 Possible Alternatives The below list has not been vetted in any way and may or may not contain alternatives; - destructuretraitobject...

accepted (>=0.2.0, <=0.3.1), acme-client (>=0.1.0, <=0.2.0) +1501 more potentially affected by unknown CVE via traitobject (>=0.0.1, <=0.1.1)

traitobject CARGO version =0.0.1, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.7.0, =0.2.0, =0.4.6 and more Source cves: unknown CVE Source advisory: OSV:GHSA-PP8R-VV2J-9J5V...

Cargo extracting malicious crates can corrupt arbitrary files

The Rust Security Response WG was notified that Cargo did not prevent extracting some malformed packages downloaded from alternate registries. An attacker able to upload packages to an alternate registry could corrupt arbitary files when Cargo downloaded the package. The severity of this...

GHSA-RFJ2-Q3H3-HM5J Cargo extracting malicious crates can corrupt arbitrary files

The Rust Security Response WG was notified that Cargo did not prevent extracting some malformed packages downloaded from alternate registries. An attacker able to upload packages to an alternate registry could corrupt arbitary files when Cargo downloaded the package. The severity of this...

GHSA-2HVR-H6GW-QRXP Cargo extracting malicious crates can fill the file system

The Rust Security Response WG was notified that Cargo did not prevent extracting some malformed packages downloaded from alternate registries. An attacker able to upload packages to an alternate registry could fill the file system when Cargo downloaded the package. The severity of this...

Cargo extracting malicious crates can fill the file system

The Rust Security Response WG was notified that Cargo did not prevent extracting some malformed packages downloaded from alternate registries. An attacker able to upload packages to an alternate registry could fill the file system when Cargo downloaded the package. The severity of this...

Ubuntu: Security Advisory (USN-5610-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...