GHSA-JP3W-3Q88-34CF Miscomputation when performing AES encryption in rust-crypto

The following Rust program demonstrates some strangeness in AES encryption - if you have an immutable key slice and then operate on that slice, you get different encryption output than if you operate on a copy of that key. For these functions, we expect that extending a 16 byte key to a 32 byte k...

ace-test-lib (0.1.0), ace_rust_demo (0.1.0) +503 more potentially affected by unknown CVE via rust-crypto (0.2.36)

rust-crypto CARGO version 0.2.36 is affected by a known vulnerability. The following packages have a transitive dependency on rust-crypto and may be impacted: - ace-test-lib 0.1.0 - acerustdemo 0.1.0 - aerospike =0.0.1, =0.1.0, =0.0.1, =0.1.0, =0.2.0, =0.1.0, =0.2.0, =0.3.5, =0.9.0, =0.1.0, =0.1....

alexcrichton-cranelift-native (>=0.52.0, <=0.53.0), alexcrichton-cranelift-simplejit (0.53.0) +138 more potentially affected by CVE-2021-45687 via raw-cpuid (>=3.1.0, <=8.1.2)

raw-cpuid CARGO version =3.1.0, =0.52.0, =0.1.0, =0.9.0, =0.26.1, =0.6.2, =0.5.0, =0.2.0, =0.8.0-alpha1, =0.3.2, =0.14.0, =0.69.0 and more Source cves: CVE-2021-45687 Source advisory: OSV:GHSA-JF5H-CF95-W759...

GHSA-JF5H-CF95-W759 Optional `Deserialize` implementations lacking validation

When activating the non-default feature serialize, most structs implement serde::Deserialize without sufficient validation. This allows breaking invariants in safe code, leading to: Undefined behavior in asstring methods which use std::str::fromutf8unchecked internally. Panics due to failed...

Optional `Deserialize` implementations lacking validation

When activating the non-default feature serialize, most structs implement serde::Deserialize without sufficient validation. This allows breaking invariants in safe code, leading to: Undefined behavior in asstring methods which use std::str::fromutf8unchecked internally. Panics due to failed...

A malicious coder can get unsound access to TCell or TLCell memory

This is impossible to do by accident, but by carefully constructing marker types to be covariant, a malicious coder can cheat the singleton check in TCellOwner and TLCellOwner, giving unsound access to cell memory. This could take the form of getting two mutable references to the same memory, or ...

GHSA-9C9F-7X9P-4WQP A malicious coder can get unsound access to TCell or TLCell memory

This is impossible to do by accident, but by carefully constructing marker types to be covariant, a malicious coder can cheat the singleton check in TCellOwner and TLCellOwner, giving unsound access to cell memory. This could take the form of getting two mutable references to the same memory, or ...

optra (>=0.1.0, <=0.2.1) potentially affected by CVE-2021-45694 via rdiff (0.1.2)

rdiff CARGO version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on rdiff and may be impacted: - optra =0.1.0, =0.2.1 Source cves: CVE-2021-45694 Source advisory: OSV:GHSA-Q579-9WP9-GFP2...

alsa (0.5.1), ceph-async (>=4.0.0, <=4.0.5) +3 more potentially affected by CVE-2021-45707 via nix (0.21.0)

nix CARGO version 0.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on nix and may be impacted: - alsa 0.5.1 - ceph-async =4.0.0, =1.4.10, =0.0.8, =0.0.13 Source cves: CVE-2021-45707 Source advisory: OSV:GHSA-WGRG-5H56-JG27...

acidalia (>=0.1.0, <=0.1.3), acl-rs (0.1.0) +863 more potentially affected by CVE-2021-45707 via nix (>=0.16.1, <=0.20.0)

nix CARGO version =0.16.1, =0.1.0, =0.1.0, =0.0.2, =0.0.9, =0.1.0, =0.5.0, =0.10.0, =0.4.4, =0.3.0, =0.3.1 - annotate-output 0.1.0 and more Source cves: CVE-2021-45707 Source advisory: OSV:GHSA-WGRG-5H56-JG27...

Use after free in Neon external buffers

Neon provides functionality for creating JavaScript ArrayBuffer and the Buffer subtype instances backed by bytes allocated outside of V8/Node. The JsArrayBuffer::external and JsBuffer::external did not require T: 'static prior to Neon 0.10.1. This allowed creating an externally backed buffer from...

directory-tree (0.0.1), etwin_email_formatter (>=0.9.0, <=0.10.0) +5 more potentially affected by unknown CVE via neon (>=0.8.3, <=0.9.1)

neon CARGO version =0.8.3, =0.9.0, =0.9.2, =1.0.0, =1.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-8MJ7-WXMC-F424...

GHSA-8MJ7-WXMC-F424 Use after free in Neon external buffers

Neon provides functionality for creating JavaScript ArrayBuffer and the Buffer subtype instances backed by bytes allocated outside of V8/Node. The JsArrayBuffer::external and JsBuffer::external did not require T: 'static prior to Neon 0.10.1. This allowed creating an externally backed buffer from...

bp7 (>=0.7.0, <=0.8.1), cala (0.9.0) +4 more potentially affected by CVE-2021-45705 via nanorand (0.5.2)

nanorand CARGO version 0.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on nanorand and may be impacted: - bp7 =0.7.0, =0.10.0, =0.8.0, =0.9.1 Source cves: CVE-2021-45705 Source advisory: OSV:GHSA-P6GJ-GPC8-F8XW...

executors (>=0.9.0, <=0.10.0), metrics (0.9.1) +8 more potentially affected by CVE-2021-45704 via metrics-util (>=0.1.0, <=0.6.2)

metrics-util CARGO version =0.1.0, =0.9.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0-alpha.1, =0.3.0 - metricsprinter 0.1.0 Source cves: CVE-2021-45704 Source advisory: OSV:GHSA-3HXH-7JXM-59X4...

airmash-protocol (>=0.2.0, <=0.3.0), altv-core (0.1.0) +211 more potentially affected by CVE-2021-45695 via mopa (0.2.2)

mopa CARGO version 0.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on mopa and may be impacted: - airmash-protocol =0.2.0, =0.5.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.5.0, =0.1.0, =0.2.0, =0.6.0, =0.7.0, =0.2.0, =0.2.0, =0.6.1 and more Source cves:...

`mopa` is technically unsound

The mopa crate redefines the deprecated TraitObject struct from core::raw like so: rust reprC deriveCopy, Clone dochidden pub struct TraitObject pub data: mut , pub vtable: mut , This is done to then transmute a reference to a trait object &dyn Trait for any trait Trait into this struct and...

account-db (0.1.0), anything (>=0.1.0, <=0.1.4) +106 more potentially affected by CVE-2021-45720 via lru (>=0.1.17, <=0.6.6)

lru CARGO version =0.1.17, =0.1.0, =0.1.1, =0.1.1, =0.1.0, =0.1.1, =0.0.1, =0.11.0, =0.3.0-beta.1, =0.1.9, =0.8.0-alpha1, =0.8.1 - cw-erc20 0.4.0 - cw-escrow 0.4.0 and more Source cves: CVE-2021-45720 Source advisory: OSV:GHSA-QQMC-HWQP-8G2W...

GHSA-F67M-9J94-QV9J Parser creates invalid uninitialized value

Affected versions of this crate called mem::uninitialized in the HTTP1 parser to create values of type httparse::Header from the httparse crate. This is unsound, since Header contains references and thus must be non-null. The flaw was corrected by avoiding the use of mem::uninitialized, using...

GHSA-RXHX-9FJ6-6H2M enum_map macro can cause UB when `Enum` trait is incorrectly implemented

Affected versions of this crate did not properly check the length of an enum when using enummap! macro, trusting user-provided length. When the LENGTH in the Enum trait does not match the array length in the EnumArray trait, this can result in the initialization of the enum map with uninitialized...