3958 matches found
CVE-2018-20990
CVE-2018-20990 affects the tar crate for Rust (pre-0.4.16). The issue is that arbitrary file overwrite can occur via a symlink or hardlink inside a TAR archive, representing a path traversal-like risk when unpacking archives. The available documents identify the vulnerable component and the under...
CVE-2018-20990
An issue was discovered in the tar crate before 0.4.16 for Rust. Arbitrary file overwrite can occur via a symlink or hardlink in a TAR archive...
CVE-2018-20993
An issue was discovered in the yaml-rust crate before 0.4.1 for Rust. There is uncontrolled recursion during deserialization...
CVE-2018-20993
An issue was discovered in the yaml-rust crate before 0.4.1 for Rust. There is uncontrolled recursion during deserialization...
CVE-2018-20992
An issue was discovered in the claxon crate before 0.4.1 for Rust. Uninitialized memory can be exposed because certain decode buffer sizes are mishandled...
CVE-2018-20992
The CVE-2018-20992 issue affects the Rust Claxon crate (pre-0.4.1). A decode-buffer size handling flaw allowed uninitialized memory to be exposed; parts of the decode buffer could be overwritten or revealed depending on the bitstream value. Public descriptions (e.g., GHSA and RustSec advisories) ...
CVE-2016-10931
An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification...
CVE-2019-15541
rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service loop of connevent and ready by arranging for a client to never be writable...
CVE-2016-10931
An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification...
Design/Logic Flaw
rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service loop of connevent and ready by arranging for a client to never be writable...
CVE-2017-18587
An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers...
CVE-2017-18587
CVE-2017-18587 (hyper crate, Rust) affects the hyper crate before 0.9.18, where header values mishandled newline characters in serialization. This can allow header fragmentation/splitting of requests or responses due to newline handling in header values. The issue is documented across multiple so...
CVE-2017-18587
An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers...
CVE-2016-10932
The CVE-2016-10932 issue affects the hyper crate for Rust on Windows before version 0.9.4, where hostname verification was omitted during HTTPS, enabling potential Man‑in‑the‑Middle (MitM) attacks. Root cause: missing hostname verification in TLS on Windows builds. Impact: interception or tamperi...
CVE-2016-10932
An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted...
CVE-2016-10931
An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification...
CVE-2019-15541
CVE-2019-15541 concerns rustls-mio/tlsserver.rs in the rustls crate prior to 0.16.0. The root cause is a denial-of-service condition caused by a loop between conn_event and ready when a client is never writable, enabling an attacker to stall connections. Affected component: rustls-mio (Rust). Imp...
CVE-2016-10931: Improper Certificate Validation
An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification...