UBUNTU-CVE-2023-38497

Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local...

bitcoin-harness (0.1.0), bitcoin_rpc_client (>=0.5.0, <=0.6.1) +78 more potentially affected by CVE-2023-53159 via openssl (>=0.10.7, <=0.10.52)

openssl CARGO version =0.10.7, =0.5.0, =0.2.0, =0.0.0, =0.0.1, =0.3.3, =0.6.25, =0.1.0-alpha.0, =0.0.3, =0.1.24, =0.37.0-pre, =0.4.0, =0.37.0-pre, =0.37.0-pre, =0.38.0 and more Source cves: CVE-2023-53159 Source advisory: OSV:GHSA-XCF7-RVMH-G6Q4...

a2 (>=0.2.0, <=0.5.0-alpha.7), abci (>=0.5.3, <=0.7.1) +4040 more potentially affected by unknown CVE via memoffset (>=0.1.0, <=0.5.6)

memoffset CARGO version =0.1.0, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.1.0, =0.1.0, =0.8.0, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.7.10 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0045...

acme-client (>=0.1.0, <=0.2.0), aerial (0.1.0) +866 more potentially affected by CVE-2023-53159 via openssl (>=0.2.18, <=0.10.52)

openssl CARGO version =0.2.18, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.7.0, =0.1.0, =0.0.10, =0.0.1, =0.1.0, =0.2.0 - apns 0.1.1 - aries 0.1.0 - arubaripple 0.0.1 and more Source cves: CVE-2023-53159 Source advisory: OSV:RUSTSEC-2023-0044...

aesti (>=0.1.0, <=0.3.0), atarashii_imap (0.3.0) +382 more potentially affected by unknown CVE via openssl (>=0.9.24, <=0.10.40)

openssl CARGO version =0.9.24, =0.1.0, =0.1.0, =0.0.0, =0.2.0, =0.15.0, =0.3.1, =0.0.1, =0.3.2, =0.1.1, =0.1.4, =0.1.0, =0.1.3, =0.1.5 and more Source cves: unknown CVE Source advisory: OSV:GHSA-3GXF-9R58-2GHG...

aesti (>=0.1.0, <=0.3.0), atarashii_imap (0.3.0) +382 more potentially affected by unknown CVE via openssl (>=0.9.24, <=0.10.40)

openssl CARGO version =0.9.24, =0.1.0, =0.1.0, =0.0.0, =0.2.0, =0.15.0, =0.3.1, =0.0.1, =0.3.2, =0.1.1, =0.1.4, =0.1.0, =0.1.3, =0.1.5 and more Source cves: unknown CVE Source advisory: OSV:GHSA-6HCF-G6GR-HHCR...

Gitoxide has renamed its crates.

All crates in the gitoxide project have been renamed from git- to gix-. The git- prefixed crates are no longer being updated. Switch to using gix-hash to continue receiving updates...

PT-2023-36087 · Gitoxide · Gitoxide

Name of the Vulnerable Software and Affected Versions: gitoxide project affected versions not specified Description: The gitoxide project has undergone a renaming of all crates from git- to gix-, with the git- prefixed crates no longer being updated. Recommendations: To continue receiving updates...

PT-2023-36086 · Gitoxide · Gitoxide

Name of the Vulnerable Software and Affected Versions: gitoxide project affected versions not specified Description: The gitoxide project has undergone a renaming of its crates from git- to gix-, with the git- prefixed crates no longer being updated. Recommendations: To continue receiving updates...

barfs (0.1.2), cranefack (0.4.1) +49 more potentially affected by CVE-2023-26489 via cranelift-codegen (>=0.84.0, <=0.90.1)

cranelift-codegen CARGO version =0.84.0, =0.84.0, =0.84.0, =0.84.0, =0.84.0, =0.84.0, =0.84.0, =0.84.0, =0.84.0, =0.84.0, =0.84.0, =0.84.0, =10.0.0, =10.0.0, =17.0.0 and more Source cves: CVE-2023-26489 Source advisory: OSV:GHSA-FF4P-7XRQ-Q5R8...

aubio-sys (>=0.2.0, <=0.2.1), bioutils (>=0.1.5, <=0.2.4) +31 more potentially affected by unknown CVE via ftp (3.0.1)

ftp CARGO version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on ftp and may be impacted: - aubio-sys =0.2.0, =0.1.5, =0.2.0, =0.32.0, =0.0.1, =0.6.0, =0.6.0, =0.1.0, =0.0.1, =1.1.1, =0.3.0, =0.5.0, =0.0.1, =0.4.17, =0.6.0 and more Source cves:...

cargo-crates (>=0.1.0, <=0.1.5), cargo-index-transit (0.1.1) +6 more potentially affected by CVE-2023-22742 via libgit2-sys (0.14.1+1.5.0)

libgit2-sys CARGO version 0.14.1+1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on libgit2-sys and may be impacted: - cargo-crates =0.1.0, =0.1.0, =2.1.8, =2.7.0, =0.6.0, =0.6.2 Source cves: CVE-2023-22742 Source advisory: OSV:GHSA-M4CH-RFV5-X5G3...

abacuz (0.1.1), addupstream (0.2.4) +800 more potentially affected by CVE-2023-22742 via libgit2-sys (>=0.1.13, <=0.13.2+1.4.2)

libgit2-sys CARGO version =0.1.13, =1.0.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =1.0.0, =3.1.3, =3.10.0 - asmuthbloomsecretsharing 0.2.2 - assemble 0.1.2 and more Source cves: CVE-2023-22742 Source advisory: OSV:GHSA-M4CH-RFV5-X5G3...

cargo-crates (>=0.1.0, <=0.1.5), cargo-index-transit (0.1.1) +6 more potentially affected by CVE-2023-22742 via libgit2-sys (0.14.1+1.5.0)

libgit2-sys CARGO version 0.14.1+1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on libgit2-sys and may be impacted: - cargo-crates =0.1.0, =0.1.0, =2.1.8, =2.7.0, =0.6.0, =0.6.2 Source cves: CVE-2023-22742 Source advisory: OSV:RUSTSEC-2023-0003...

AZL-12969 CVE-2022-46176 affecting package rust for versions less than 1.68.2-1

Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle MITM attacks. This vulnerability has been assigned...

a2s (>=0.1.0, <=0.5.1), abxml (>=0.5.0, <=0.6.2) +227 more potentially affected by CVE-2023-22895 via bzip2 (>=0.2.3, <=0.3.3)

bzip2 CARGO version =0.2.3, =0.1.0, =0.5.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0-alpha.6, =0.1.3, =0.1.0, =0.1.0, =0.3.0, =2020.5.26, =0.1.0, =0.2.0, =1.0.0 and more Source cves: CVE-2023-22895 Source advisory: OSV:GHSA-96JV-R488-C2RJ...

a2s (>=0.1.0, <=0.5.1), abxml (>=0.5.0, <=0.6.2) +227 more potentially affected by CVE-2023-22895 via bzip2 (>=0.2.3, <=0.3.3)

bzip2 CARGO version =0.2.3, =0.1.0, =0.5.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0-alpha.6, =0.1.3, =0.1.0, =0.1.0, =0.3.0, =2020.5.26, =0.1.0, =0.2.0, =1.0.0 and more Source cves: CVE-2023-22895 Source advisory: OSV:RUSTSEC-2023-0004...

askai (0.1.0), doh-client (3.1.2) +25 more potentially affected by CVE-2023-22466 via tokio (>=1.19.2, <=1.20.1)

tokio CARGO version =1.19.2, =2.3.0, =4.1.2, =1.4.0, =1.18.1, =0.2.0, =0.16.0, =0.16.0, =0.16.0, =0.16.0, =0.16.1 and more Source cves: CVE-2023-22466 Source advisory: OSV:GHSA-7RRJ-XR53-82P7...

abci-storage (0.0.3), bench-trie (>=0.12.0, <=0.12.2) +289 more potentially affected by unknown CVE via parity-util-mem (>=0.1.0, <=0.12.0)

parity-util-mem CARGO version =0.1.0, =0.12.0, =0.7.0, =0.8.8, =1.0.0, =2.0.0, =0.1.0, =0.1.0, =0.2.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0080...

UBUNTU-CVE-2022-36114

Cargo is a package manager for the rust programming language. It was discovered that Cargo did not limit the amount of data extracted from compressed archives. An attacker could upload to an alternate registry a specially crafted package that extracts way more data than its size also known as a...