PT-2025-23647 · Crates.Io · Users

Affected versions append root to group listings, unless the correct listing has exactly 1024 groups. This affects both: - The supplementary groups of a user - The group access list of the current process If the caller uses this information for access control, this may lead to privilege...

PT-2024-40974 · Crates.Io · Xous

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned, so the information cannot be determined. Description: The issue concerns the as slice and as slice mut functions, which are considered unsound. This is because any pointer, regardless of its bit...

airframe_recovery_bundle (>=1.0.0, <=1.0.2), cryptoballot (>=0.2.0, <=0.3.1) +11 more potentially affected by unknown CVE via sharks (>=0.3.3, <=0.5.0)

sharks CARGO version =0.3.3, =1.0.0, =0.2.0, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.7.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0398...

Fedora 41 : rust-hyper-rustls / rust-reqwest / rust-rustls-native-certs / etc (2024-347164df1c)

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-347164df1c advisory. - Update the hyper-rustls crate to version 0.27.3. - Update the reqwest crate to version 0.12.8. - Update the rustls-native-certs crate to version 0.8.0 and...

`fast-float` has multiple soundness issues

fast-float contains multiple soundness issues: 1. Undefined behavior when checking input length, which has been merged but no package pubished. 1. Many functions marked as safe with non-local safety guarantees The library is also unmaintained. Alternatives For quickly parsing floating-point numbe...

gpiocdev (>=0.4.3, <=0.7.0), gpiocdev-embedded-hal (0.1.0) +1 more potentially affected by CVE-2024-51756 via cap-std (3.0.0)

cap-std CARGO version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cap-std and may be impacted: - gpiocdev =0.4.3, =0.16.0, =0.16.3 Source cves: CVE-2024-51756 Source advisory: OSV:GHSA-HXF5-99XG-86HW...

Fedora: Security Advisory (FEDORA-2023-6f419dc91b)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

a11ywatch_cli (>=0.0.5, <=0.10.15), a4 (>=0.0.2, <=0.0.4) +11094 more potentially affected by unknown CVE via proc-macro-error (>=0.2.6, <=1.0.4)

proc-macro-error CARGO version =0.2.6, =0.0.5, =0.0.2, =0.3.0, =1.0.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.6.0-beta.1, =0.6.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0370...

ayaka-model (0.2.0), ayaka-runtime (0.2.0) +26 more potentially affected by unknown CVE via zerovec (>=0.2.3, <=0.8.1)

zerovec CARGO version =0.2.3, =0.3.0, =0.6.0, =1.0.0-beta1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-XRV3-JMCP-374J...

s2n-quic (>=1.18.0, <=1.34.0), s2n-quic-tls (>=0.18.2, <=0.34.0) +2 more potentially affected by unknown CVE via s2n-tls (>=0.0.6, <=0.2.6)

s2n-tls CARGO version =0.0.6, =1.18.0, =0.18.2, =0.18.2, =0.0.6, =0.2.6 Source cves: unknown CVE Source advisory: OSV:GHSA-52XF-5P2M-9WRV...

SUSE CVE-2023-40030

Cargo downloads a Rust project's dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject nearly arbitrar...

gitoxide (>=0.1.0, <=0.15.0) potentially affected by CVE-2024-35197 via gitoxide-core (>=0.1.0, <=0.17.0)

gitoxide-core CARGO version =0.1.0, =0.1.0, =0.15.0 Source cves: CVE-2024-35197 Source advisory: OSV:GHSA-49JC-R788-3FC9...

SUSE CVE-2024-34063

vodozemac is an implementation of Olm and Megolm in pure Rust. Versions 0.5.0 and 0.5.1 of vodozemac have degraded secret zeroization capabilities, due to changes in third-party cryptographic dependencies the Dalek crates, which moved secret zeroization capabilities behind a feature flag and...

Degraded secret zeroization capabilities

Versions 0.5.0 and 0.5.1 of vodozemac have degraded secret zeroization capabilities, due to changes in third-party cryptographic dependencies the Dalek crates, which moved secret zeroization capabilities behind a feature flag while vodozemac disabled the default feature set. Impact The degraded...

blind-rsa-signatures (0.9.0), cyfs-base (>=0.5.0, <=0.6.7) +4 more potentially affected by unknown CVE via rsa-export (>=0.1.2, <=0.3.3)

rsa-export CARGO version =0.1.2, =0.5.0, =0.5.0, =0.2.7, =0.1.2, =0.1.4 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0333...

emulsion (>=6.0.0, <=10.0.0), libavif-sys (>=0.8.0, <=0.15.0) +1 more potentially affected by unknown CVE via libdav1d-sys (>=0.2.0, <=0.6.0)

libdav1d-sys CARGO version =0.2.0, =6.0.0, =0.8.0, =0.9.4, =0.10.1 Source cves: unknown CVE Source advisory: OSV:GHSA-MC39-H54G-PVW6...

a-gpt (>=0.1.0, <=0.4.0), abacuz (0.1.1) +1149 more potentially affected by unknown CVE via libgit2-sys (>=0.1.13, <=0.15.2+1.6.4)

libgit2-sys CARGO version =0.1.13, =0.1.0, =1.1.0, =0.0.1, =0.3.0, =1.0.0, =0.1.0, =0.1.0, =0.3.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-22Q8-GHMQ-63VF...

a-gpt (>=0.1.0, <=0.4.0), abacuz (0.1.1) +1149 more potentially affected by CVE-2024-24575 +1 more via libgit2-sys (>=0.1.13, <=0.15.2+1.6.4)

libgit2-sys CARGO version =0.1.13, =0.1.0, =1.1.0, =0.0.1, =0.3.0, =1.0.0, =0.1.0, =0.1.0, =0.3.3 and more Source cves: CVE-2024-24575, CVE-2024-24577 Source advisory: OSV:RUSTSEC-2024-0013...

Medium: rust

Issue Overview: Cargo downloads a Rust project's dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject...

Medium: rust

Issue Overview: Cargo downloads a Rust project's dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject...