at51 (>=0.1.1, <=0.4.1), atrac3p-decoder (>=0.1.0, <=0.1.2) +51 more potentially affected by CVE-2023-53156 via transpose (0.1.0)

transpose CARGO version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transpose and may be impacted: - at51 =0.1.1, =0.1.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =2.6.2, =0.6.0, =0.1.0, =0.1.0, =0.1.1 and more Source...

GHSA-3MV5-343C-W2QG Ref methods into_ref, into_mut, into_slice, and into_slice_mut are unsound when used with cell::Ref or cell::RefMut

This advisory is also published as RUSTSEC-2023-0074. The Ref methods intoref, intomut, intoslice, and intoslicemut are unsound and may allow safe code to exhibit undefined behavior when used with Ref where B is cell::Ref or cell::RefMut. Note that these methods remain sound when used with B type...

Ref methods into_ref, into_mut, into_slice, and into_slice_mut are unsound when used with cell::Ref or cell::RefMut

This advisory is also published as RUSTSEC-2023-0074. The Ref methods intoref, intomut, intoslice, and intoslicemut are unsound and may allow safe code to exhibit undefined behavior when used with Ref where B is cell::Ref or cell::RefMut. Note that these methods remain sound when used with B type...

Fedora 38 : clevis-pin-tpm2 / keyring-ima-signer / libkrun / rust-bodhi-cli / etc (2023-6215ea423b)

The remote Fedora 38 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-6215ea423b advisory. Affected applications were rebuilt against version 0.10.60 of the the openssl crate the Rust bindings for OpenSSL to address two security advisories: -...

acme-client (>=0.1.0, <=0.2.0), aerial (0.1.0) +868 more potentially affected by unknown CVE via openssl (>=0.2.18, <=0.10.57)

openssl CARGO version =0.2.18, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.7.0, =0.1.0, =0.0.10, =0.0.1, =0.1.0, =0.2.0 - apns 0.1.1 - aries 0.1.0 - arubaripple 0.0.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0072...

RUSTSEC-2023-0118 `win_run_rs` was removed from crates.io for malicious code

This crate was part of a typosquatting malware cluster published by the user Kraded to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available...

cpython-json (>=0.1.0, <=0.3.0), crowbar (>=0.1.0, <=0.2.0) +33 more potentially affected by unknown CVE via cpython (>=0.1.0, <=0.7.2)

cpython CARGO version =0.1.0, =0.1.0, =0.1.0, =0.1.0, =2.0.0-beta, =0.1.0, =0.0.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.2.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0076...

rusty_paseto vulnerable to private key extraction due to ed25519-dalek dependency

Impact The vulnerability, known as RUSTSEC-2022-0093, impacts the ed25519-dalek crate, which is a dependency of the rusty-paseto crate. This issue arises from a "Double Public Key Signing Function Oracle Attack" affecting versions of ed25519-dalek prior to v2.0. These versions expose an unsafe AP...

GHSA-J57R-4QW6-58R3 rusty_paseto vulnerable to private key extraction due to ed25519-dalek dependency

Impact The vulnerability, known as RUSTSEC-2022-0093, impacts the ed25519-dalek crate, which is a dependency of the rusty-paseto crate. This issue arises from a "Double Public Key Signing Function Oracle Attack" affecting versions of ed25519-dalek prior to v2.0. These versions expose an unsafe AP...

acme-client (>=0.1.0, <=0.2.0), aerial (0.1.0) +691 more potentially affected by unknown CVE via hpack (>=0.2.0, <=0.3.0)

hpack CARGO version =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.7.0, =0.0.1, =0.1.0, =0.5.0, =0.6.5 - arubaripple 0.0.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0084...

ahqstore_cli_rs (>=1.0.0-rc10, <=1.0.0-rc11), algebraics (>=0.1.2, <=0.2.0) +244 more potentially affected by unknown CVE via inventory (>=0.1.10, <=0.1.11)

inventory CARGO version =0.1.10, =1.0.0-rc10, =0.1.2, =0.11.0, =0.2.0, =0.1.0, =0.6.0, =0.7.0, =0.6.0, =0.5.0, =0.6.0, =0.4.0, =0.6.0, =0.5.0, =0.15.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0058...

RUSTSEC-2023-0091 Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86\_64

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gw5p-q8mj-p7gh. For more information see the GitHub-hosted security advisory...

a2 (>=0.2.0, <=0.6.2), abacuz (>=0.1.0, <=0.1.1) +3002 more potentially affected by CVE-2018-16875 via webpki (>=0.18.1, <=0.21.4)

webpki CARGO version =0.18.1, =0.2.0, =0.1.0, =0.2.0-beta.4, =0.1.1, =0.0.1, =0.0.7-alpha.3, =0.0.7-alpha.2, =0.0.7-alpha.1, =0.0.7-alpha.3, =1.0.0, =0.1.0, =0.8.0, =0.1.0, =0.2.2, =1.0.0, =1.0.7 and more Source cves: CVE-2018-16875 Source advisory: OSV:RUSTSEC-2023-0052...

anchor-client (0.26.0), basejmp (0.1.0) +226 more potentially affected by unknown CVE via dlopen_derive (0.1.4)

dlopenderive CARGO version 0.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on dlopenderive and may be impacted: - anchor-client 0.26.0 - basejmp 0.1.0 - bonfida-test-utils 0.1.0 - bonfida-utils =0.2.3, =0.2.0, =0.14.0, =0.1.0, =0.1.0, =0.29.0, =0.1....

a4 (>=0.0.1, <=0.0.4), a4-core (>=0.0.3, <=0.0.4) +964 more potentially affected by unknown CVE via atomic-polyfill (1.0.3)

atomic-polyfill CARGO version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on atomic-polyfill and may be impacted: - a4 =0.0.1, =0.0.3, =0.23.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.4.1, =0.5.2 and more Source cves: unknown...

a2 (>=0.2.0, <=0.5.0-alpha.7), abci (>=0.5.3, <=0.7.1) +4044 more potentially affected by unknown CVE via memoffset (>=0.1.0, <=0.5.6)

memoffset CARGO version =0.1.0, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.1.0, =0.1.0, =0.8.0, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.7.10 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0045...

aries-askar (>=0.1.2, <=0.2.7), arkworks-r1cs-gadgets (>=0.5.0, <=1.2.0) +108 more potentially affected by unknown CVE via xsalsa20poly1305 (>=0.4.2, <=0.9.1)

xsalsa20poly1305 CARGO version =0.4.2, =0.1.2, =0.5.0, =0.5.0, =0.2.0-pre.1, =0.1.0, =0.1.0, =0.1.1 - bramble-handshake 0.1.0 - bramble-qr 0.1.0 - bramble-rendezvous 0.1.0 - bramble-sync 0.1.0 - bramble-transport 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0037...

RUSTSEC-2023-0092 Undefined Behavior in Rust runtime functions

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-ch89-5g45-qwc7. For more information see the GitHub-hosted security advisory...

Undefined Behavior in Rust runtime functions

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-ch89-5g45-qwc7. For more information see the GitHub-hosted security advisory...

aware (>=0.0.1, <=0.0.6), aws-config (>=0.0.22-alpha, <=0.0.26-alpha) +288 more potentially affected by CVE-2023-30610 via aws-sigv4 (>=0.0.22-alpha, <=0.0.26-alpha)

aws-sigv4 CARGO version =0.0.22-alpha, =0.0.1, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.26-alpha and more Source cves:...