Fedora 40 : rust-sequoia-chameleon-gnupg / rust-sequoia-gpg-agent / etc (2024-12f0caa904)

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-12f0caa904 advisory. - Update the sequoia-openpgp crate to version 1.21.1. Addresses RUSTSEC-2024-0345. - Update the sequoia-keystore crate to version 0.5.1. - Update the...

ayaka-model (0.2.0), baked (1.0.0) +15 more potentially affected by unknown CVE via zerovec-derive (>=0.6.0, <=0.8.0)

zerovec-derive CARGO version =0.6.0, =0.6.0, =1.0.0-beta1 - icuproviderblob 1.0.0-beta1 - icusegmenter 1.0.0-alpha1 - icusegmenterlstm 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0346...

a2d (>=0.1.0, <=0.1.11), abstract-adapter-utils (>=0.16.0, <=0.19.2) +2457 more potentially affected by unknown CVE via derivative (>=1.0.4, <=2.2.0)

derivative CARGO version =1.0.4, =0.1.0, =0.16.0, =0.1.0-rc.2, =0.0.1, =0.1.0-rc.2, =0.2.0-beta.4, =0.2.0-beta.4, =0.0.1, =0.0.1, =0.0.1, =0.1.0-rc.1, =0.0.1, =0.14.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0388...

atuin (>=0.3.0, <=0.4.0), bibliographix (>=0.1.0, <=0.6.0) +19 more potentially affected by unknown CVE via chrono-english (0.1.8)

chrono-english CARGO version 0.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on chrono-english and may be impacted: - atuin =0.3.0, =0.1.0, =1.9.0, =0.2.0, =0.1.0, =0.4.2, =0.4.0, =0.0.4, =0.1.0, =0.1.0, =0.1.0, =0.10.0, =0.12.2 and more Source cves...

assimp (>=0.0.4, <=0.0.6), autoperf (>=0.9.0, <=0.9.5) +55 more potentially affected by unknown CVE via mmap (0.1.1)

mmap CARGO version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on mmap and may be impacted: - assimp =0.0.4, =0.9.0, =0.1.0, =0.1.0, =0.1.2, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.0.3 and more Source cves: unknown CVE Source advisory:...

serde_yml

serdeyml Deprecated YAML library for Rust. The 0.0.13 relea...

Fedora 40 : rust-h2 (2024-f99ee6bf95)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-f99ee6bf95 advisory. Update to version 0.3.26. Addresses RUSTSEC-2024-0332. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

acril-http (0.1.0), adafruit_io_http (>=0.1.0, <=0.1.1) +943 more potentially affected by CVE-2024-32650 via rustls (>=0.12.0, <=0.21.5)

rustls CARGO version =0.12.0, =0.1.0, =0.3.5, =0.3.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =0.0.1, =0.5.2, =0.1.0, =0.2.0, =0.1.1, =0.2.1 - applinheadless 0.1.0 and more Source cves: CVE-2024-32650 Source advisory: OSV:RUSTSEC-2024-0336...

RUSTSEC-2024-0335 gix-transport indirect code execution via malicious username

Summary gix-transport does not check the username part of a URL for text that the external ssh program would interpret as an option. A specially crafted clone URL can smuggle options to SSH. The possibilities are syntactically limited, but if a malicious clone URL is used by an application whose...

Fedora 39 : rust-h2 (2024-638f25a317)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-638f25a317 advisory. Update to version 0.3.26. Addresses RUSTSEC-2024-0332. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

Fedora 38 : rust-h2 (2024-c5b42e6462)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-c5b42e6462 advisory. Update to version 0.3.26. Addresses RUSTSEC-2024-0332. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

RUSTSEC-2024-0441 Panic when using a dropped extenref-typed element segment

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-75hq-h6g9-h4q5. For more information see the GitHub-hosted security advisory...

Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2024-574)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-574 advisory. RUSTSEC-2024-0006 NOTE: https://rustsec.org/advisories/RUSTSEC-2024-0006.html NOTE: https://github.com/comex/rust-shlex/security/advisories/GHSA-r7qv-8r2h-pg27 Tenable has extracted the preceding...

Amazon Linux 2023 : aws-nitro-enclaves-cli, aws-nitro-enclaves-cli-devel, aws-nitro-enclaves-cli-integration-tests (ALAS2023-2024-575)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-575 advisory. RUSTSEC-2024-0006 NOTE: https://rustsec.org/advisories/RUSTSEC-2024-0006.html NOTE: https://github.com/comex/rust-shlex/security/advisories/GHSA-r7qv-8r2h-pg27 Tenable has extracted the preceding...

Amazon Linux 2 : aws-nitro-enclaves-cli (ALASNITRO-ENCLAVES-2024-039)

The version of aws-nitro-enclaves-cli installed on the remote host is prior to 1.2.3-0. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2024-039 advisory. RUSTSEC-2024-0006 NOTE: https://rustsec.org/advisories/RUSTSEC-2024-0006.html NOTE:...

bpxe-bpmn-schema (0.1.2), companion-service (0.1.0) +30 more potentially affected by unknown CVE via linkme (>=0.1.6, <=0.2.10)

linkme CARGO version =0.1.6, =0.1.2, =0.1.0, =0.1.0, =0.0.2-alpha, =0.0.2-alpha, =0.1.0, =0.2.1, =0.2.3, =0.0.1, =0.13.4 - kaspa-perf-monitor 0.13.4 - melodium 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0407...

GHSA-R8W9-5WCG-VFJ7 Mio's tokens for named pipes may be delivered after deregistration

Impact When using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be...

emulsion (>=6.0.0, <=10.0.0), libavif-sys (>=0.8.0, <=0.15.0) +1 more potentially affected by CVE-2024-1580 via libdav1d-sys (>=0.2.0, <=0.6.0)

libdav1d-sys CARGO version =0.2.0, =6.0.0, =0.8.0, =0.9.4, =0.10.1 Source cves: CVE-2024-1580 Source advisory: OSV:RUSTSEC-2024-0016...

acid-rs (>=1.1.0, <=1.1.1), agpm_pm (>=0.0.1, <=0.0.2) +836 more potentially affected by CVE-2024-24575 +1 more via libgit2-sys (>=0.1.13, <=0.15.2+1.6.4)

libgit2-sys CARGO version =0.1.13, =1.1.0, =0.0.1, =0.3.0, =1.0.0, =0.1.0, =2.0.0-rc.1, =0.2.0, =0.1.0, =0.1.0, =0.1.1 and more Source cves: CVE-2024-24575, CVE-2024-24577 Source advisory: OSV:RUSTSEC-2024-0013...

carpo (>=0.1.2, <=0.1.3) potentially affected by unknown CVE via conrod (0.61.1)

conrod CARGO version 0.61.1 is affected by a known vulnerability. The following packages have a transitive dependency on conrod and may be impacted: - carpo =0.1.2, =0.1.3 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0397...