12760 matches found
Improper Certificate Validation in openssl
All versions of rust-openssl prior to 0.9.0 contained numerous insecure defaults including off-by-default certificate verification and no API to perform hostname verification. Unless configured correctly by a developer, these defaults could allow an attacker to perform man-in-the-middle attacks...
acme-client (>=0.1.0, <=0.2.0), aerial (0.1.0) +676 more potentially affected by CVE-2016-10931 via openssl (>=0.2.18, <=0.8.3)
openssl CARGO version =0.2.18, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.7.0, =0.1.0, =0.0.10, =0.0.1, =0.1.0, =0.2.0, =0.2.1 and more Source cves: CVE-2016-10931 Source advisory: OSV:GHSA-34P9-F4Q3-C4R7...
GHSA-PQ6V-X7GP-7776 Source code is downloaded over cleartext HTTP in portaudio
An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP...
baal (>=0.1.0, <=0.3.0), bit_crusher (0.2.0) +12 more potentially affected by CVE-2016-10933 via portaudio (>=0.4.19, <=0.6.4)
portaudio CARGO version =0.4.19, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1, =0.5.0, =0.2.0, =0.4.0, =0.1.0, =0.5.0, =0.8.0, =0.11.0 - volume 0.2.0 Source cves: CVE-2016-10933 Source advisory: OSV:GHSA-PQ6V-X7GP-7776...
Source code is downloaded over cleartext HTTP in portaudio
An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP...
GHSA-9XJR-M6F3-V5WM HTTPS MitM vulnerability due to lack of hostname verification
When used on Windows platforms, all versions of Hyper prior to 0.9.4 did not perform hostname verification when making HTTPS requests. This allows an attacker to perform MitM attacks by preventing any valid CA-issued certificate, even if there's a hostname mismatch. The problem was addressed by...
aerial (0.1.0), afterparty (0.1.0) +334 more potentially affected by CVE-2016-10932 via hyper (>=0.0.1, <=0.8.1)
hyper CARGO version =0.0.1, =0.7.0, =0.1.0, =0.1.3, =0.5.1, =0.1.2, =0.5.3, =0.1.0, =0.1.0, =0.3.0 and more Source cves: CVE-2016-10932 Source advisory: OSV:GHSA-9XJR-M6F3-V5WM...
aerial (0.1.0), afterparty (0.1.0) +341 more potentially affected by CVE-2017-18587 via hyper (>=0.0.1, <=0.9.14)
hyper CARGO version =0.0.1, =0.7.0, =0.1.0, =0.1.3, =0.5.1, =0.1.2, =0.5.3, =0.1.0, =0.1.0, =0.3.0 and more Source cves: CVE-2017-18587 Source advisory: OSV:GHSA-Q89X-F52W-6HJ2...
acme-client (>=0.1.0, <=0.2.0), aerial (0.1.0) +690 more potentially affected by CVE-2017-18589 via cookie (>=0.1.21, <=0.6.2)
cookie CARGO version =0.1.21, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.7.0, =0.1.0, =0.0.1, =0.0.1, =0.1.0, =0.5.0, =0.6.5 and more Source cves: CVE-2017-18589 Source advisory: OSV:GHSA-VJRQ-CG9X-RFJP...
alumina (>=0.1.0, <=0.1.1), amethyst_animation (0.1.0) +95 more potentially affected by CVE-2018-20991 via smallvec (>=0.3.4, <=0.5.1)
smallvec CARGO version =0.3.4, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.2, =0.6.2, =0.1.0, =0.1.0, =0.0.1, =0.0.22 and more Source cves: CVE-2018-20991 Source advisory: OSV:GHSA-RXR4-X558-X7HW...
RUSTSEC-2021-0099 Crate has been renamed to `cosmrs`
The cosmossdk crate, which provides a basic Rust SDK for the Cosmos ecosystem, has rebranded to “CosmRS” in the spirit of other projects like CosmJS and CosmWasm. You can find the new home here: https://github.com/cosmos/cosmos-rust/tree/main/cosmrs The new crate name is cosmrs:...
Crate has been renamed to `cosmrs`
The cosmossdk crate, which provides a basic Rust SDK for the Cosmos ecosystem, has rebranded to “CosmRS” in the spirit of other projects like CosmJS and CosmWasm. You can find the new home here: https://github.com/cosmos/cosmos-rust/tree/main/cosmrs The new crate name is cosmrs:...
Use after free in actix-service
An issue was discovered in the actix-service crate before 1.0.6 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data...
Use-after-free in actix-http
An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust. There is a use-after-free in BodyStream...
Double free in algorithmica
An issue was discovered in the algorithmica crate through 2021-03-07 for Rust. In the affected versions of this crate, mergesort::merge wildly duplicates and drops ownership of T without guarding against double-free. Due to such implementation, simply invoking mergesort::merge on Vec can cause...
Use-after-free in actix-codec
An issue was discovered in the actix-codec crate before 0.3.0-beta.1 for Rust. There is a use-after-free in Framed...
Free of uninitialized memory in adtensor
An issue was discovered in the adtensor crate through 0.0.3 for Rust. There is a drop of uninitialized memory via the FromIterator implementation for Vector and Matrix...
Update unsound DrainFilter and RString::retain
An issue was discovered in the abistable crate before 0.9.1 for Rust. DrainFilter lacks soundness because of a double drop...
