GHSA-3M6F-3GFG-4X56 Panic on incorrect date input to `simple_asn1`

Version 0.6.0 of the simpleasn1 crate panics on certain malformed inputs to its parsing functions, including fromder and derdecode. Because this crate is frequently used with inputs from the network, this should be considered a security vulnerability. The issue occurs when parsing the old ASN.1...

abc (>=0.1.0, <=0.2.3), aerospike (>=0.0.1, <=1.3.0) +273 more potentially affected by unknown CVE via crossbeam (>=0.1.6, <=0.2.12)

crossbeam CARGO version =0.1.6, =0.1.0, =0.0.1, =0.1.0, =0.2.0, =0.2.0, =0.4.0, =0.4.0, =0.4.0, =0.1.0, =0.1.3, =0.11.0 - bmengine 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0029...

shakmaty-syzygy (>=0.1.0, <=0.11.1), static_init (>=1.0.0, <=1.0.4) potentially affected by unknown CVE via double-checked-cell (>=1.1.0, <=2.1.0)

double-checked-cell CARGO version =1.1.0, =0.1.0, =1.0.0, =1.0.4 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0024...

amethyst-console (0.1.0), amethyst-imgui (>=0.5.0, <=0.6.0) +50 more potentially affected by unknown CVE via crossbeam-queue (>=0.1.2, <=0.2.0)

crossbeam-queue CARGO version =0.1.2, =0.5.0, =0.1.0, =0.7.0, =0.8.0, =0.7.0, =0.6.0, =0.8.0, =0.7.0, =0.9.0, =0.6.0, =0.6.0, =0.0.1, =0.0.1, =0.2.0, =0.15.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0021...

abc (>=0.1.0, <=0.2.3), aerospike (>=0.0.1, <=1.3.0) +413 more potentially affected by unknown CVE via crossbeam (>=0.1.6, <=0.6.0)

crossbeam CARGO version =0.1.6, =0.1.0, =0.0.1, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.5.0, =0.1.0, =0.2.0, =0.6.0, =0.7.0, =0.2.0, =0.2.0, =0.1.0, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0020...

ace-test-lib (0.1.0), ace_rust_demo (0.1.0) +503 more potentially affected by unknown CVE via rust-crypto (0.2.36)

rust-crypto CARGO version 0.2.36 is affected by a known vulnerability. The following packages have a transitive dependency on rust-crypto and may be impacted: - ace-test-lib 0.1.0 - acerustdemo 0.1.0 - aerospike =0.0.1, =0.1.0, =0.0.1, =0.1.0, =0.2.0, =0.1.0, =0.2.0, =0.3.5, =0.9.0, =0.1.0, =0.1....

RUSTSEC-2022-0096 Invalid drop of VMExternRef from partially-initialized instances in the pooling instance allocator

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-88xq-w8cq-xfg7. For more information see the GitHub-hosted security advisory...

a4 (>=0.0.2, <=0.0.4), aaa_csv_challenge (0.1.0) +2651 more potentially affected by unknown CVE via structopt (>=0.0.3, <=0.3.26)

structopt CARGO version =0.0.3, =0.0.2, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.7.5, =0.1.0, =0.3.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0104...

a2kit (>=0.1.0, <=2.0.6), actions-github (>=0.0.2, <=0.1.0) +452 more potentially affected by unknown CVE via json (>=0.3.4, <=0.12.4)

json CARGO version =0.3.4, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.9.0, =0.9.0, =0.13.0, =0.1.0, =0.3.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0081...

glog (0.1.0), simconnect (0.1.4) +3 more potentially affected by unknown CVE via thread_local (1.0.1)

threadlocal CARGO version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on threadlocal and may be impacted: - glog 0.1.0 - simconnect 0.1.4 - skia-bindings =0.37.0, =0.37.0, =0.5.0, =0.5.1 Source cves: unknown CVE Source advisory:...

bme280-multibus (>=0.1.0, <=0.2.1), eeprom25aa02e48 (>=0.1.0, <=0.2.0) potentially affected by unknown CVE via ftd2xx-embedded-hal (>=0.1.0, <=0.9.1)

ftd2xx-embedded-hal CARGO version =0.1.0, =0.1.0, =0.1.0, =0.2.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0005...

artifact-app (>=0.5.0, <=0.6.1), binary_macros (>=0.1.0, <=0.2.0) +4 more potentially affected by unknown CVE via dotenv_codegen (>=0.7.2, <=0.15.0)

dotenvcodegen CARGO version =0.7.2, =0.5.0, =0.1.0, =0.7.0, =0.1.0, =0.2.2 - smbcloud-wallet-constants 1.0.7 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2021-0142...

a14_cargo_io (0.1.0), abk (>=0.1.0, <=0.1.1) +262 more potentially affected by unknown CVE via dotenv (>=0.4.0, <=0.15.0)

dotenv CARGO version =0.4.0, =0.1.0, =0.0.0, =0.2.0, =0.2.0, =0.1.0, =0.5.2, =0.2.0, =0.5.0, =0.9.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2021-0141...

a2lfile (0.8.0), abrute (>=0.1.7, <=0.1.9) +502 more potentially affected by unknown CVE via encoding (0.2.33)

encoding CARGO version 0.2.33 is affected by a known vulnerability. The following packages have a transitive dependency on encoding and may be impacted: - a2lfile 0.8.0 - abrute =0.1.7, =0.5.0, =2.4.0, =0.1.0, =0.1.0, =0.0.1, =0.2.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.6.0 - assembly-core 0.1.0 an...

Panic on incorrect date input to `simple_asn1`

Version 0.6.0 of the simpleasn1 crate panics on certain malformed inputs to its parsing functions, including fromder and derdecode. Because this crate is frequently used with inputs from the network, this should be considered a security vulnerability. The issue occurs when parsing the old ASN.1...

actaeon (>=0.1.1, <=0.2.1), alexandria (0.2.0) +128 more potentially affected by unknown CVE via sodiumoxide (>=0.0.4, <=0.2.7)

sodiumoxide CARGO version =0.0.4, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.0.5, =0.1.0, =0.2.0, =0.2.0, =0.0.1, =0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2021-0137...

aes-keywrap-rs (>=0.1.0, <=0.2.0), shadowsocks-crypto (>=0.1.0, <=0.2.5) potentially affected by CVE-2021-45709 via crypto2 (0.1.2)

crypto2 CARGO version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on crypto2 and may be impacted: - aes-keywrap-rs =0.1.0, =0.1.0, =0.2.5 Source cves: CVE-2021-45709 Source advisory: OSV:RUSTSEC-2021-0121...

accepted (>=0.2.0, <=0.3.1), acme-client (>=0.1.0, <=0.2.0) +1501 more potentially affected by unknown CVE via traitobject (>=0.0.1, <=0.1.1)

traitobject CARGO version =0.0.1, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.7.0, =0.2.0, =0.4.6 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2021-0144...

RUSTSEC-2021-0144 traitobject is Unmaintained

Crate traitobject has not had a release for over five years. In addition there is an existing security advisory that has not been addressed: - RUSTSEC-2020-0027 Possible Alternatives The below list has not been vetted in any way and may or may not contain alternatives; - destructuretraitobject...

acidalia (>=0.1.0, <=0.1.3), acl-rs (0.1.0) +863 more potentially affected by CVE-2021-45707 via nix (>=0.16.1, <=0.20.0)

nix CARGO version =0.16.1, =0.1.0, =0.1.0, =0.0.2, =0.0.9, =0.1.0, =0.5.0, =0.10.0, =0.4.4, =0.3.0, =0.3.1 - annotate-output 0.1.0 and more Source cves: CVE-2021-45707 Source advisory: OSV:RUSTSEC-2021-0119...