ALPINE-CVE-2019-16760

Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the package configuration key. Usage of the package key to rename dependencies in Cargo.toml is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is used Cargo may download the wrong dependency,...

Design/Logic Flaw

Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the package configuration key. Usage of the package key to rename dependencies in Cargo.toml is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is used Cargo may download the wrong dependency,...

CVE-2019-16760

Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the package configuration key. Usage of the package key to rename dependencies in Cargo.toml is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is used Cargo may download the wrong dependency,...

CVE-2019-16760

CVE-2019-16760 affects Cargo in Rust releases up to 1.25.0, where the package key in Cargo.toml can cause Cargo to download the wrong dependency. This could allow a malicious package to be substituted when building manifests (affecting locally written and crates.io published manifests). The advis...

CVE-2019-16760

Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the package configuration key. Usage of the package key to rename dependencies in Cargo.toml is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is used Cargo may download the wrong dependency,...

CVE-2019-16760

Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the package configuration key. Usage of the package key to rename dependencies in Cargo.toml is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is used Cargo may download the wrong dependency,...

CVE-2019-16760 Cargo prior to Rust 1.26.0 may download the wrong dependency

Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the package configuration key. Usage of the package key to rename dependencies in Cargo.toml is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is used Cargo may download the wrong dependency,...

CVE-2019-16760: Download of Code Without Integrity Check

Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the package configuration key. Usage of the package key to rename dependencies in Cargo.toml is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is used Cargo may download the wrong dependency,...

openSUSE Security Update : rust (openSUSE-2019-2203)

This update for rust fixes the following issues : Rust was updated to version 1.36.0. Security issues fixed : - CVE-2019-12083: a standard method can be overridden violating Rust's safety guarantees and causing memory unsafety bsc1134978 - CVE-2018-1000622: rustdoc loads plugins from world-writab...

airust (0.1.6), akaze (>=0.1.0, <=0.1.2) +300 more potentially affected by CVE-2019-16138 via image (>=0.10.4, <=0.20.1)

image CARGO version =0.10.4, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.5, =0.1.0, =0.1.0, =0.1.0, =0.11.0, =0.1.0, =0.1.0, =0.0.4, =0.1.0, =0.2.8 and more Source cves: CVE-2019-16138 Source advisory: OSV:RUSTSEC-2019-0014...

Compromising vital infrastructure: air traffic control

While most of us know that flying is the safest mode of transport, we still feel that sigh of relief when the plane has made its landing on the runway and we can text our loved ones that we have arrived safe and sound. Accidents may be rare, but they're often shocking and horrific and accompanied...

Moderate: Red Hat Enhancement Advisory: new packages: rust-toolset-1.29

New rust-toolset-1.29 packages are now available as a part of Red Hat Developer Tools for Red Hat Enterprise Linux. Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, the cargo-vendor plugin, and required libraries. This enhancement...

amethyst_config (0.3.0), amqpr (>=0.1.0, <=0.2.2) +147 more potentially affected by unknown CVE via serde_yaml (>=0.6.2, <=0.7.5)

serdeyaml CARGO version =0.6.2, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.1.1, =3.1.3, =0.1.0, =0.1.1, =0.2.4, =0.3.1-alpha.2, =0.4.0, =0.4.4 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2018-0005...

aa2 (>=0.9.0, <=0.9.1), abridge (>=1.0.0, <=1.1.6) +429 more potentially affected by CVE-2018-20993 via yaml-rust (>=0.2.2, <=0.3.5)

yaml-rust CARGO version =0.2.2, =0.9.0, =1.0.0, =0.0.1, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.0.0, =0.1.0, =1.0.0, =0.0.2, =0.0.1, =1.0.0, =1.3.4 - asuran-cli 0.1.1 and more Source cves: CVE-2018-20993 Source advisory: OSV:RUSTSEC-2018-0006...

cargo.rzd.ru XSS vulnerability

Open Bug Bounty ID: OBB-649570 Description| Value ---|--- Affected Website:| cargo.rzd.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Threat Outbreak Alert RuleID33088: Email Messages Distributing Malicious Software on July 4, 2018

Medium Alert ID: 58361 First Published: 2018 July 5 15:43 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID33088 may contain the following files: Name | Size...

async_docker (>=0.1.0, <=0.1.1), cargo (>=0.4.0, <=0.8.0) +11 more potentially affected by CVE-2018-20990 via tar (>=0.2.14, <=0.3.4)

tar CARGO version =0.2.14, =0.1.0, =0.4.0, =0.3.1, =0.1.0, =0.3.0, =0.2.0, =0.2.0, =0.2.1, =0.0.1, =0.0.9 - wormhole 0.1.0 Source cves: CVE-2018-20990 Source advisory: OSV:RUSTSEC-2018-0002...

cargo-records.de XSS vulnerability

Open Bug Bounty ID: OBB-623944 Description| Value ---|--- Affected Website:| cargo-records.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Stealing container ship cargo through LOC messaging

In a previous post post I looked at hacking and manipulating EDIFACT messages to destabilise a ship. However, criminals will be far more interested in using these techniques to re-route containers and steal their contents. Similar techniques appear to have been used to steal containers in the pas...

Threat Outbreak Alert RuleID32761: Email Messages Distributing Malicious Software on May 11, 2018

Medium Alert ID: 57876 First Published: 2018 May 11 17:07 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32761 may contain the following files: Name | Size...