DEBIAN-CVE-2025-59825

astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the Entry::unpackinraw API. Additionally, the Entry::allowexternalsymlinks control which...

UBUNTU-CVE-2025-59825

astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the Entry::unpackinraw API. Additionally, the Entry::allowexternalsymlinks control which...

CVE-2025-59825

CVE-2025-59825 affects astral-tokio-tar (Rust) up to v0.5.3: tar extraction can escape the target dir via Entry::unpack_in_raw and via a symlink pair that bypasses allow_external_symlinks, potentially enabling arbitrary file writes and code execution. The issue is fixed in v0.5.4; upgrading is re...

CVE-2025-59825 astral-tokio-tar has a path traversal in tar extraction

astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the Entry::unpackinraw API. Additionally, the Entry::allowexternalsymlinks control which...

CVE-2025-59825

astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the Entry::unpackinraw API. Additionally, the Entry::allowexternalsymlinks control which...

GHSA-3WGQ-WRWC-VQMV astral-tokio-tar has a path traversal in tar extraction

Impact In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the Entry::unpackinraw API. Additionally, the Entry::allowexternalsymlinks control which defaults to true could be bypassed via a pair of symlinks that...

astral-tokio-tar has a path traversal in tar extraction

Impact In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the Entry::unpackinraw API. Additionally, the Entry::allowexternalsymlinks control which defaults to true could be bypassed via a pair of symlinks that...

astral-tokio-tar 安全漏洞

astral-tokio-tar is a Rust library open-sourced by Astral. A security vulnerability exists in astral-tokio-tar 0.5.3 and earlier versions, which stems from a path traversal issue in the Entryunpackinraw API and the Entryallowexternalsymlinks control that can be bypassed, potentially leading to...

An issue was discovered in the tokio crate before 1.8.1 for Rust. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread.

...

tracing 安全漏洞

tracing is an open source application from Tokio. A security vulnerability exists in tracing versions prior to 0.3.20, which stems from ANSI escape sequence injection and could lead to endpoint manipulation...

Linux Distros Unpatched Vulnerability : CVE-2023-22466

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows...

Slab 缓冲区错误漏洞

Slab is a Rust application open-sourced by Tokio. A buffer error vulnerability exists in slab version 0.4.10, which stems from the getdisjointmut method incorrectly checking index ranges, which could lead to accessing uninitialized memory...

Azure Linux 3.0 Security Update: kata-containers / kata-containers-cc / rpm-ostree (CVE-2024-27308)

The version of kata-containers / kata-containers-cc / rpm-ostree installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-27308 advisory. - Mio is a Metal I/O library for Rust. When using named pipes on...

assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +7 more potentially affected by CVE-2025-54804 via russh (>=0.34.0, <=0.43.0)

russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2025-54804 Source advisory: OSV:GHSA-H5RC-J5F5-3GCM...

CVE-2023-6180

The tokio-boring library in version 4.0.0 is affected by a memory leak issue that can lead to excessive resource consumption and potential DoS by resource exhaustion. The setexdata function used by the library did not deallocate memory used by pre-existing data in memory each time after completin...

CVE-2023-22466

Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows named pipe server, setting pipemode will reset rejectremoteclients to false. If the application has previously configured...

CVE-2021-38191

An issue was discovered in the tokio crate before 1.8.1 for Rust. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread...

CVE-2020-35875

An issue was discovered in the tokio-rustls crate before 0.13.1 for Rust. Excessive memory usage may occur when data arrives quickly...

gitforge (>=0.1.0, <=0.2.0), gitlab (>=0.1311.1, <=0.1404.0) +8 more potentially affected by unknown CVE via tokio (>=1.40.0, <=1.42.1)

tokio CARGO version =1.40.0, =0.1.0, =0.1311.1, =0.3.0, =1.0.0, =0.1.1, =0.1.4 - tokio-macros 2.4.0 - xensec-internal-tools 0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-RR8G-9FPQ-6WMG...

a2 (>=0.5.0-alpha.1, <=0.5.3), aahc (0.1.0) +4943 more potentially affected by unknown CVE via tokio (>=0.2.5, <=1.38.1)

tokio CARGO version =0.2.5, =0.5.0-alpha.1, =0.1.0, =0.1.0, =0.1.0, =0.4.0, =0.5.0, =0.1.0, =0.1.0, =0.0.1, =0.0.7-alpha.3, =0.0.7-alpha.2, =0.0.7-alpha.1, =0.0.7-alpha.3, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-RR8G-9FPQ-6WMG...