GHSA-RR8G-9FPQ-6WMG Tokio broadcast channel calls clone in parallel, but does not require `Sync`

The broadcast channel internally calls clone on the stored value when receiving it, and only requires T:Send. This means that using the broadcast channel with values that are Send but not Sync can trigger unsoundness if the clone implementation makes use of the value being !Sync. Thank you to...

async-func (0.2.4), file-operation (0.5.2) +5 more potentially affected by unknown CVE via tokio (1.44.1)

tokio CARGO version 1.44.1 is affected by a known vulnerability. The following packages have a transitive dependency on tokio and may be impacted: - async-func 0.2.4 - file-operation 0.5.2 - hyperlane-log =1.10.7, =3.5.2, =2.1.3, =2.2.0 - server-manager 3.1.2 Source cves: unknown CVE Source...

a2 (>=0.5.0-alpha.1, <=0.5.3), aahc (0.1.0) +4943 more potentially affected by unknown CVE via tokio (>=0.2.5, <=1.38.1)

tokio CARGO version =0.2.5, =0.5.0-alpha.1, =0.1.0, =0.1.0, =0.1.0, =0.4.0, =0.5.0, =0.1.0, =0.1.0, =0.0.1, =0.0.7-alpha.3, =0.0.7-alpha.2, =0.0.7-alpha.1, =0.0.7-alpha.3, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0023...

moiradb (>=0.3.0, <=0.3.1) potentially affected by unknown CVE via tokio (1.40.0)

tokio CARGO version 1.40.0 is affected by a known vulnerability. The following packages have a transitive dependency on tokio and may be impacted: - moiradb =0.3.0, =0.3.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0023...

async-func (0.2.4), file-operation (0.5.2) +5 more potentially affected by unknown CVE via tokio (1.44.1)

tokio CARGO version 1.44.1 is affected by a known vulnerability. The following packages have a transitive dependency on tokio and may be impacted: - async-func 0.2.4 - file-operation 0.5.2 - hyperlane-log =1.10.7, =3.5.2, =2.1.3, =2.2.0 - server-manager 3.1.2 Source cves: unknown CVE Source...

CVE-2024-27308

Mio is a Metal I/O library for Rust. When using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some...

GHSA-QG5G-GV98-5FFH rustls network-reachable panic in `Acceptor::accept`

A bug introduced in rustls 0.23.13 leads to a panic if the received TLS ClientHello is fragmented. Only servers that use rustls::server::Acceptor::accept are affected. Servers that use tokio-rustls's LazyConfigAcceptor API are affected. Servers that use tokio-rustls's TlsAcceptor API are not...

rustls network-reachable panic in `Acceptor::accept`

A bug introduced in rustls 0.23.13 leads to a panic if the received TLS ClientHello is fragmented. Only servers that use rustls::server::Acceptor::accept are affected. Servers that use tokio-rustls's LazyConfigAcceptor API are affected. Servers that use tokio-rustls's TlsAcceptor API are not...

rustls network-reachable panic in `Acceptor::accept`

A bug introduced in rustls 0.23.13 leads to a panic if the received TLS ClientHello is fragmented. Only servers that use rustls::server::Acceptor::accept are affected. Servers that use tokio-rustls's LazyConfigAcceptor API are affected. Servers that use tokio-rustls's TlsAcceptor API are not...

RUSTSEC-2024-0399 rustls network-reachable panic in `Acceptor::accept`

A bug introduced in rustls 0.23.13 leads to a panic if the received TLS ClientHello is fragmented. Only servers that use rustls::server::Acceptor::accept are affected. Servers that use tokio-rustls's LazyConfigAcceptor API are affected. Servers that use tokio-rustls's TlsAcceptor API are not...

candid-extractor (>=0.1.0, <=0.1.2), purewasm (0.1.0) +12 more potentially affected by CVE-2024-47763 via wasmtime (12.0.2)

wasmtime CARGO version 12.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - candid-extractor =0.1.0, =12.0.0, =12.0.0, =12.0.0, =0.1.2, =0.3.0, =12.0.0, =12.0.0, =12.0.0, =12.0.0, =12.0.0, =12.0.2 Source cves:...

Fedora: Security Advisory (FEDORA-2023-f81c1ab1e6)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2023-d88521bfc5)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CBL Mariner 2.0 Security Update: kata-containers / kata-containers-cc / rpm-ostree (CVE-2024-27308)

The version of kata-containers / kata-containers-cc / rpm-ostree installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-27308 advisory. - Mio is a Metal I/O library for Rust. When using named pipes on...

CBL Mariner 2.0 Security Update: rust / netavark / kata-containers / rpm-ostree (CVE-2023-22466)

The version of rust / netavark / kata-containers / rpm-ostree installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-22466 advisory. - Tokio is a runtime for writing applications with Rust. Starting with...

Security Bulletin: mio-0.8.10.crate, and mio-0.8.8.crate is vulnerable to CVE-2024-27308 used in IBM Maximo Application Suite - Edge Data Collector

Summary IBM Maximo Application Suite - Edge Data Collector uses mio-0.8.10.crate and mio-0.8.8.crate which is vulnerable to CVE-2024-27308 Vulnerability Details CVEID:CVE-2024-27308 DESCRIPTION: Tokio Mio s vulnerable to a denial of service, caused by a use-after-free flaw due to tokens for named...

Fedora 40 : rust-axum / rust-tokio-tungstenite / rust-tungstenite / rust-warp (2023-f81c1ab1e6)

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-f81c1ab1e6 advisory. - Update the axum crate to version 0.6.20. - Update the tokio-tungstenite crate to version 0.20.1. - Update the tungstenite crate to version 0.20.1. - Port...

SUSE CVE-2024-27308

Mio is a Metal I/O library for Rust. When using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some...

RUSTSEC-2024-0336 `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input

If a closenotify alert is received during a handshake, completeio does not terminate. Callers which do not call completeio are not affected. rustls-tokio and rustls-ffi do not call completeio and are not affected. rustls::Stream and rustls::StreamOwned types use completeio and are affected...

The vulnerability of the h2 library in the Rust programming language in the Tokio environment, related to unlimited resource distribution, allows attackers to cause service failures.

The vulnerability of the h2 library in the Rust programming language in the Tokio environment is related to unlimited resource distribution. Exploiting this vulnerability can allow a remote attacker to cause service failures...