Manjusaka: A Chinese sibling of Sliver and Cobalt Strike

By Asheer Malhotra and Vitor Ventura. Cisco Talos recently discovered a new attack framework called "Manjusaka" being used in the wild that has the potential to become prevalent across the threat landscape. This framework is advertised as an imitation of the Cobalt Strike framework. The implants...

CVE-2022-35922

Rust-WebSocket is a WebSocket RFC6455 library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an out-of-memory OOM process abort in a client or a server. The root cause of the issue is during dataframe parsing. Affected versions would allocate a buffer based...

Design/Logic Flaw

Rust-WebSocket is a WebSocket RFC6455 library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an out-of-memory OOM process abort in a client or a server. The root cause of the issue is during dataframe parsing. Affected versions would allocate a buffer based...

CVE-2022-35922

Rust-WebSocket (rust-websocket) prior to 0.26.5 is vulnerable: untrusted data during dataframe parsing can drive an allocation based on a declar ed size, causing an OOM abort in the sync (non-Tokio) path; the async path does not use Vec::with_capacity, so DoS is tied to delivered oversized data. ...

CVE-2022-35922 Memory allocation based on untrusted length in rust-websocket

Rust-WebSocket is a WebSocket RFC6455 library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an out-of-memory OOM process abort in a client or a server. The root cause of the issue is during dataframe parsing. Affected versions would allocate a buffer based...

CVE-2022-35922 Memory allocation based on untrusted length in rust-websocket

Rust-WebSocket is a WebSocket RFC6455 library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an out-of-memory OOM process abort in a client or a server. The root cause of the issue is during dataframe parsing. Affected versions would allocate a buffer based...

CVE-2022-35922 Memory allocation based on untrusted length in rust-websocket

Rust-WebSocket is a WebSocket RFC6455 library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an out-of-memory OOM process abort in a client or a server. The root cause of the issue is during dataframe parsing. Affected versions would allocate a buffer based...

CVE-2022-35922

Rust-WebSocket is a WebSocket RFC6455 library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an out-of-memory OOM process abort in a client or a server. The root cause of the issue is during dataframe parsing. Affected versions would allocate a buffer based...

CVE-2022-31173

Juniper is a GraphQL server library for Rust. Affected versions of Juniper are vulnerable to uncontrolled recursion resulting in a program crash. This issue has been addressed in version 0.15.10. Users are advised to upgrade. Users unable to upgrade should limit the recursion depth manually...

CVE-2022-31173 Juniper is vulnerable to @DOS GraphQL Nested Fragments overflow

Juniper is a GraphQL server library for Rust. Affected versions of Juniper are vulnerable to uncontrolled recursion resulting in a program crash. This issue has been addressed in version 0.15.10. Users are advised to upgrade. Users unable to upgrade should limit the recursion depth manually...

CVE-2022-31173

CVE-2022-31173 affects the Juniper GraphQL server library for Rust. Affected versions are vulnerable to uncontrolled recursion, causing a program crash (denial of service). The issue is addressed in version 0.15.10; users should upgrade. If upgrading is not possible, a manual limit on recursion d...

RUSTSEC-2022-0035 Unbounded memory allocation based on untrusted length

Impact Untrusted websocket connections can cause an out-of-memory OOM process abort in a client or a server. The root cause of the issue is during dataframe parsing. Affected versions would allocate a buffer based on the declared dataframe size, which may come from an untrusted source. When...

Unbounded memory allocation based on untrusted length

Impact Untrusted websocket connections can cause an out-of-memory OOM process abort in a client or a server. The root cause of the issue is during dataframe parsing. Affected versions would allocate a buffer based on the declared dataframe size, which may come from an untrusted source. When...

Rust-WebSocket resource management error vulnerability

Rust-WebSocket is a Rust-based WebSocket library. A resource management error vulnerability exists in Rust-WebSocket versions prior to 0.26.5, which stems from the fact that an untrusted websocket connection may cause an out-of-memory OOM process to abort on the client or server. The root cause o...

CVE-2022-31173: Uncontrolled Resource Consumption

Juniper is a GraphQL server library for Rust. Affected versions of Juniper are vulnerable to uncontrolled recursion resulting in a program crash. This issue has been addressed in version 0.15.10. Users are advised to upgrade. Users unable to upgrade should limit the recursion depth manually...

GraphQL-Rust resource management error vulnerability

graphql-rust is a Rust-based GraphQL server library. A resource management error vulnerability exists in versions of graphql-rust Juniper prior to 0.15.10, which stems from vulnerability to uncontrolled recursion that can cause a program to crash...

CVE-2022-35922: Uncontrolled Resource Consumption

Rust-WebSocket is a WebSocket RFC6455 library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an out-of-memory OOM process abort in a client or a server. The root cause of the issue is during dataframe parsing. Affected versions would allocate a buffer based...

automaat-processor-git-clone (0.1.0), automaat-processor-json-edit (0.1.0) +29 more potentially affected by CVE-2022-31173 via juniper (>=0.7.0, <=0.15.8)

juniper CARGO version =0.7.0, =0.3.0-development-1, =0.3.0-development-1, =0.3.0-development-1, =0.3.0-development-1, =0.3.0-development-1, =0.3.0-development-1, =0.3.0-development-1, =0.3.0-development-1, =0.3.0-development-2 and more Source cves: CVE-2022-31173 Source advisory:...

automaat-processor-git-clone (0.1.0), automaat-processor-json-edit (0.1.0) +29 more potentially affected by CVE-2022-31173 via juniper (>=0.7.0, <=0.15.8)

juniper CARGO version =0.7.0, =0.3.0-development-1, =0.3.0-development-1, =0.3.0-development-1, =0.3.0-development-1, =0.3.0-development-1, =0.3.0-development-1, =0.3.0-development-1, =0.3.0-development-1, =0.3.0-development-2 and more Source cves: CVE-2022-31173 Source advisory:...

Information disclosure

Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the possibility of printing sensitive...