GHSA-WQXC-QRQ4-W5V4 Update unsound DrainFilter and RString::retain

An issue was discovered in the abistable crate before 0.9.1 for Rust. A retain call can create an invalid UTF-8 string, violating soundness...

aerospike (0.3.0), airmash-protocol (>=0.2.5, <=0.3.0) +149 more potentially affected by CVE-2021-32810 via crossbeam-deque (>=0.1.1, <=0.6.3)

crossbeam-deque CARGO version =0.1.1, =0.2.5, =0.6.0, =0.5.0, =0.4.0, =0.5.0, =0.6.0, =0.7.0, =0.3.0, =0.3.0, =0.1.0, =0.6.0, =0.6.0, =0.1.0, =0.2.0 and more Source cves: CVE-2021-32810 Source advisory: OSV:GHSA-PQQP-XMHJ-WGCW...

use-after-free vulnerability in Rust array-queue

An issue was discovered in the array-queue crate through 2020-09-26 for Rust. A popback call may lead to a use-after-free...

GHSA-75CQ-G75G-RXFF use-after-free vulnerability in Rust array-queue

An issue was discovered in the array-queue crate through 2020-09-26 for Rust. A popback call may lead to a use-after-free...

b2b (0.1.0), crust (>=0.0.7, <=0.0.65) +15 more potentially affected by CVE-2017-1000168 via sodiumoxide (>=0.0.4, <=0.0.13)

sodiumoxide CARGO version =0.0.4, =0.0.7, =0.5.0, =2.0.1, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =0.1.4, =0.0.1, =0.1.0, =0.2.0 and more Source cves: CVE-2017-1000168 Source advisory: OSV:GHSA-2WC6-2RCJ-8V76...

timeout_io (>=0.2.0, <=0.2.7) potentially affected by CVE-2020-36438 via tiny_future (0.3.2)

tinyfuture CARGO version 0.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on tinyfuture and may be impacted: - timeoutio =0.2.0, =0.2.7 Source cves: CVE-2020-36438 Source advisory: OSV:GHSA-M296-J53X-XV95...

acto-rs (>=0.2.9, <=0.3.7), alumina (>=0.1.0, <=0.1.1) +154 more potentially affected by CVE-2018-25023 via smallvec (>=0.1.8, <=0.5.1)

smallvec CARGO version =0.1.8, =0.2.9, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =1.1.0, =1.3.0 and more Source cves: CVE-2018-25023 Source advisory: OSV:GHSA-66P5-J55P-32R9...

amethyst_config (0.3.0), annotate-snippets (>=0.0.1, <=0.1.0) +119 more potentially affected by unknown CVE via serde_yaml (>=0.6.2, <=0.7.5)

serdeyaml CARGO version =0.6.2, =0.0.1, =3.1.3, =0.1.0, =0.1.1, =0.1.0, =0.2.4, =0.3.1-alpha.2, =0.4.0, =0.0.1, =0.0.51, =0.1.0, =0.5.1+deprecated and more Source cves: unknown CVE Source advisory: OSV:GHSA-39VW-QP34-RMWF...

SyncChannel<T> can move 'T: !Send' to other threads

Affected versions of this crate unconditionally implement Send/Sync for SyncChannel. SyncChannel doesn't provide access to &T but merely serves as a channel that consumes and returns owned T. Users can create UB in safe Rust by sending T: !Send to other threads with SyncChannel::send/recv APIs...

term-handler (0.1.0) potentially affected by CVE-2020-36446 via signal-simple (0.1.1)

signal-simple CARGO version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on signal-simple and may be impacted: - term-handler 0.1.0 Source cves: CVE-2020-36446 Source advisory: OSV:GHSA-8892-84WF-CG8F...

arsdk-rs (>=0.0.2, <=0.0.5), burritun (>=0.1.0, <=0.1.1) +38 more potentially affected by CVE-2019-25054 via pnet (>=0.12.0, <=0.26.0)

pnet CARGO version =0.12.0, =0.0.2, =0.1.0, =1.3.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1, =0.0.1, =0.3.0, =0.5.1 - jumpingsumo-rs 0.0.2 - kipa 0.1.2 and more Source cves: CVE-2019-25054 Source advisory: OSV:GHSA-R6FF-2Q3C-V3PV...

dataflow (0.1.0), fasten (>=0.1.8, <=0.4.4) +5 more potentially affected by CVE-2020-36463 via multiqueue (0.3.2)

multiqueue CARGO version 0.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on multiqueue and may be impacted: - dataflow 0.1.0 - fasten =0.1.8, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.1.6, =0.1.7 Source cves: CVE-2020-36463 Source advisory:...

Data races in model

Shared data structure in model crate implements Send and Sync traits regardless of the inner type. This allows safe Rust code to trigger a data race, which is undefined behavior in Rust. Users are advised to treat Shared as an unsafe type. It should not be used outside of the testing context, and...

GHSA-8Q64-WRFR-Q48C Data races in model

Shared data structure in model crate implements Send and Sync traits regardless of the inner type. This allows safe Rust code to trigger a data race, which is undefined behavior in Rust. Users are advised to treat Shared as an unsafe type. It should not be used outside of the testing context, and...

toolbox (>=0.2.7-final, <=0.2.8) potentially affected by CVE-2020-36432 via alg_ds (0.2.7)

algds CARGO version 0.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on algds and may be impacted: - toolbox =0.2.7-final, =0.2.8 Source cves: CVE-2020-36432 Source advisory: OSV:GHSA-3VV3-FRRQ-6486...

Use of Uninitialized Resource in alg_ds

An issue was discovered in the algds crate through 2020-08-25 for Rust. Matrix::new internally calls Matrix::fillwith which uses ptr = value pattern to initialize the buffer. This pattern assumes that there is an initialized struct at the address and drops it, which results in dropping of...

GHSA-3VV3-FRRQ-6486 Use of Uninitialized Resource in alg_ds

An issue was discovered in the algds crate through 2020-08-25 for Rust. Matrix::new internally calls Matrix::fillwith which uses ptr = value pattern to initialize the buffer. This pattern assumes that there is an initialized struct at the address and drops it, which results in dropping of...

Data races in bunch

An issue was discovered in the bunch crate through 2020-11-12 for Rust. Affected versions of this crate unconditionally implements Send/Sync for Bunch. This allows users to insert T: !Sync to Bunch. It is possible to create a data race to a T: !Sync by invoking the Bunch::get API which returns &T...

term-handler (0.1.0) potentially affected by CVE-2020-36446 via signal-simple (0.1.1)

signal-simple CARGO version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on signal-simple and may be impacted: - term-handler 0.1.0 Source cves: CVE-2020-36446 Source advisory: OSV:GHSA-36CG-4JFF-5863...

GHSA-36CG-4JFF-5863 Data races in signal-simple

Affected versions of this crate unconditionally implement Send/Sync for SyncChannel. SyncChannel doesn't provide access to &T but merely serves as a channel that consumes and returns owned T. Users can create UB in safe Rust by sending T: !Send to other threads with SyncChannel::send/recv APIs...