GHSA-3M6F-3GFG-4X56 Panic on incorrect date input to `simple_asn1`

Version 0.6.0 of the simpleasn1 crate panics on certain malformed inputs to its parsing functions, including fromder and derdecode. Because this crate is frequently used with inputs from the network, this should be considered a security vulnerability. The issue occurs when parsing the old ASN.1...

Panic on incorrect date input to `simple_asn1`

Version 0.6.0 of the simpleasn1 crate panics on certain malformed inputs to its parsing functions, including fromder and derdecode. Because this crate is frequently used with inputs from the network, this should be considered a security vulnerability. The issue occurs when parsing the old ASN.1...

a2 (>=0.5.0-alpha.6 <=0.5.0-alpha.7), abci-rs (=0.2.0) +425 more potentially affected by unknown CVE via crossbeam-queue (>=0.1.2 <=0.2.0)

crossbeam-queue CARGO version =0.1.2, =0.5.0-alpha.6, =0.0.2, =0.0.1, =0.1.0-alpha.2, =0.1.5, =0.12.0, =0.5.0, =0.1.0, =0.3.0 - amethyst-navigation =0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0021...

a2 (>=0.2.0 <=0.3.6), abc (>=0.1.0 <=0.2.3) +521 more potentially affected by unknown CVE via crossbeam (>=0.1.6 <=0.6.0)

crossbeam CARGO version =0.1.6, =0.2.0, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =0.2.0, =0.5.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.8.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0020...

deno (>=0.35.0 <=1.3.0), diss (>=0.0.1 <=0.2.10) +8 more potentially affected by unknown CVE via pty (>=0.1.6 <=0.2.2)

pty CARGO version =0.1.6, =0.35.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.0.0, =0.1.0 - webterm-rs =0.1.4 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0015...

openssl-sys (>=0.9.35 <=0.9.37) potentially affected by CVE-2022-0778 via openssl-src (=110.0.7+1.1.0i)

openssl-src CARGO version =110.0.7+1.1.0i is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - openssl-sys =0.9.35, =0.9.37 Source cves: CVE-2022-0778 Source advisory: OSV:RUSTSEC-2022-0014...

auto-wasi (=0.1.0), ceres-executor (>=0.1.0 <=0.2.0) +43 more potentially affected by CVE-2022-23636 +1 more via wasmtime (>=0.10.0 <=0.33.0)

wasmtime CARGO version =0.10.0, =0.1.0, =0.40.1, =0.45.0, =0.1.0, =0.1.0, =0.3.3, =0.1.0, =0.8.0, =0.8.0, =0.8.1 - tc-executor-wasmtime =0.8.0 and more Source cves: CVE-2022-23636, CVE-2022-31169 Source advisory: OSV:RUSTSEC-2022-0096...

RUSTSEC-2022-0096 Invalid drop of VMExternRef from partially-initialized instances in the pooling instance allocator

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-88xq-w8cq-xfg7. For more information see the GitHub-hosted security advisory...

bme280-multibus (>=0.1.0 <=0.2.1), eeprom25aa02e48 (>=0.1.0 <=0.2.0) potentially affected by unknown CVE via ftd2xx-embedded-hal (>=0.1.0 <=0.9.1)

ftd2xx-embedded-hal CARGO version =0.1.0, =0.1.0, =0.1.0, =0.2.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0005...

odbc-avro (>=0.1.0 <=0.2.1), odbc-iter (>=0.1.0 <=0.2.7) +6 more potentially affected by unknown CVE via odbc (>=0.10.2 <=0.9.17)

odbc CARGO version =0.10.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.1, =0.1.0, =0.1.1 - unidbpgsql =0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0039...

azoth (=0.1.0), azoth-lmdb (>=0.1.0 <=0.2.5) +26 more potentially affected by unknown CVE via lmdb (>=0.7.2 <=0.8.0)

lmdb CARGO version =0.7.2, =0.1.0, =0.1.0, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.9.3, =0.1.0, =1.3.3, =0.1.0, =0.1.0, =0.5.0, =0.8.4 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0001...

GSL (>=0.4.25 <=0.4.26), IMAPServer (=0.0.0) +4479 more potentially affected by unknown CVE via rustc-serialize (>=0.1.5 <=0.3.25)

rustc-serialize CARGO version =0.1.5, =0.4.25, =0.1.0, =0.1.7, =0.2.0-beta.4, =0.0.6, =0.1.0, =0.2.1, =0.1.4, =0.1.1, =0.3.0 - ace-test-lib =0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0004...

adiscord (>=0.0.1 <=0.0.3), alpaca-data-api (>=0.1.0 <=0.1.2) +20 more potentially affected by unknown CVE via dotenv_codegen (>=0.10.0 <=0.9.3)

dotenvcodegen CARGO version =0.10.0, =0.0.1, =0.1.0, =0.5.0, =0.1.0, =0.1.0, =0.1.2, =0.7.0, =0.1.0, =0.1.0, =0.3.0 - meep =1.0.1 - ncrsdk =0.1.0 - new-rawr =0.0.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2021-0142...

Panic on incorrect date input to `simple_asn1`

Version 0.6.0 of the simpleasn1 crate panics on certain malformed inputs to its parsing functions, including fromder and derdecode. Because this crate is frequently used with inputs from the network, this should be considered a security vulnerability. The issue occurs when parsing the old ASN.1...

arrow (>=0.14.0 <=4.4.0), arrow-flight (>=2.0.0 <=4.4.0) +73 more potentially affected by unknown CVE via flatbuffers (>=0.4.0 <=22.12.6)

flatbuffers CARGO version =0.4.0, =0.14.0, =2.0.0, =1.0.0, =0.2.0, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.17.0, =0.1.1, =0.1.0, =0.1.0, =0.1.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2021-0122...

RUSTSEC-2021-0144 traitobject is Unmaintained

Crate traitobject has not had a release for over five years. In addition there is an existing security advisory that has not been addressed: - RUSTSEC-2020-0027 Possible Alternatives The below list has not been vetted in any way and may or may not contain alternatives; - destructuretraitobject...

GHSA-V5M7-53CV-F3HX crossbeam-channel Undefined Behavior before v0.4.4

Impact The affected version of this crate's the bounded channel incorrectly assumes that Vec::fromiter has allocated capacity that same as the number of iterator elements. Vec::fromiter does not actually guarantee that and may allocate extra memory. The destructor of the bounded channel...

LemoGUI (=0.0.1-nightly), acidalia (>=0.1.0 <=0.1.3) +215 more potentially affected by unknown CVE via spirv_headers (>=1.4.2 <=1.5.0)

spirvheaders CARGO version =1.4.2, =0.1.0, =0.1.0, =0.5.4, =1.0.9, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.4.0, =0.6.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2021-0096...

Boa (>=0.4.0 <=0.13.1), HPGO (=0.9.2) +3715 more potentially affected by unknown CVE via serde_cbor (>=0.10.2 <=0.9.0)

serdecbor CARGO version =0.10.2, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2, =0.4.1, =0.8.0, =0.9.0, =0.1.0, =0.1.0, =1.0.0, =1.0.3 - accurate =0.3.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2021-0127...

RUSTSEC-2021-0103 Partial read is incorrect in molecule

Anyone who uses totalsize.. function to partial read the length of any FixVec will get an incorrect result, due to an incorrect implementation. This has been resolved in the 0.7.2 release...