Malicious code in rustdecimal (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e33f42f05c60c6d9f9297bae15a43d6c445e2ad0fd67fa4ef144e5cc79d09c7 The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained...

RUSTSEC-2022-0050 Interledger is Unmaintained

Interledger family of crates is not being actively maintained anymore. The owner of the published crate does not appear to be responsive. There is an outstanding concern around username comparison. This concern may or may not be resolved by bumping up the dependencies of the project...

Interledger is Unmaintained

Interledger family of crates is not being actively maintained anymore. The owner of the published crate does not appear to be responsive. There is an outstanding concern around username comparison. This concern may or may not be resolved by bumping up the dependencies of the project...

a3mo_lib (>=0.1.0, <=0.1.1), abacuz (0.1.1) +664 more potentially affected by CVE-2022-35737 via libsqlite3-sys (>=0.0.9, <=0.24.2)

libsqlite3-sys CARGO version =0.0.9, =0.1.0, =0.1.0, =0.1.0, =0.5.0, =0.0.1, =0.1.0, =0.0.2, =0.2.11, =0.1.0, =1.0.0, =0.0.2-alpha, =0.1.0, =0.4.1 and more Source cves: CVE-2022-35737 Source advisory: OSV:GHSA-JW36-HF63-69R9...

PT-2022-37421 · Unknown · Interledger

Name of the Vulnerable Software and Affected Versions: Interledger affected versions not specified Description: The Interledger family of crates is no longer actively maintained, and the owner of the published crate is unresponsive. There is a concern regarding username comparison, which may or m...

GHSA-9HPW-R23R-XGM5 Data race in `Iter` and `IterMut`

In the affected version of this crate, Iter, IterMut::next used a weaker memory ordering when loading values than what was required, exposing a potential data race when iterating over a ThreadLocal's values. Crates using Iter::next, or IterMut::next are affected by this issue...

Data race in `Iter` and `IterMut`

In the affected version of this crate, Iter, IterMut::next used a weaker memory ordering when loading values than what was required, exposing a potential data race when iterating over a ThreadLocal's values. Crates using Iter::next, or IterMut::next are affected by this issue...

RUSTSEC-2022-0071 Rusoto is unmaintained

The maintainers of Rusoto advise that all its crates are deprecated. This includes the common crates rusotocore, rusotosignature, rusotocredential, and service crates such as rusotos3 and rusotoec2. Users should migrate to the AWS SDK for Rust, which is maintained by AWS...

Rusoto is unmaintained

The maintainers of Rusoto advise that all its crates are deprecated. This includes the common crates rusotocore, rusotosignature, rusotocredential, and service crates such as rusotos3 and rusotoec2. Users should migrate to the AWS SDK for Rust, which is maintained by AWS...

alexcrichton-cranelift-native (>=0.52.0, <=0.53.0), alexcrichton-cranelift-simplejit (0.53.0) +153 more potentially affected by CVE-2021-45687 via raw-cpuid (>=3.1.0, <=8.1.2)

raw-cpuid CARGO version =3.1.0, =0.52.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.9.0, =0.26.1, =0.6.2, =0.5.0, =0.2.0, =0.5.1 and more Source cves: CVE-2021-45687 Source advisory: OSV:GHSA-W428-F65R-H4Q2...

cargo-download is unmaintained

The cargo download subcommand via cargo-download crate is broken and maintainer has disappeared from GitHub and hasn't had any commits for a year. Using this downloader will result to corrupted crates. Maintainer has not responded to maintenance takeover. Just use wget / curl directly...

RUSTSEC-2021-0133 cargo-download is unmaintained

The cargo download subcommand via cargo-download crate is broken and maintainer has disappeared from GitHub and hasn't had any commits for a year. Using this downloader will result to corrupted crates. Maintainer has not responded to maintenance takeover. Just use wget / curl directly...

aes-keywrap-rs (>=0.1.0, <=0.2.0), shadowsocks (>=1.10.0, <=1.12.3) +1 more potentially affected by CVE-2021-45709 via crypto2 (0.1.2)

crypto2 CARGO version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on crypto2 and may be impacted: - aes-keywrap-rs =0.1.0, =1.10.0, =0.1.0, =0.2.5 Source cves: CVE-2021-45709 Source advisory: OSV:RUSTSEC-2021-0121...

acid-store (>=0.12.0, <=0.14.2), aliyundrive-fuse (>=0.1.0, <=0.1.14) +41 more potentially affected by unknown CVE via fuser (>=0.4.1, <=0.15.1)

fuser CARGO version =0.4.1, =0.12.0, =0.1.0, =0.2.4, =1.0.0, =0.2.0, =0.1.0, =0.1.0, =0.1.2, =0.6.0, =1.5.5, =0.2.5, =0.2.82 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2021-0154...

crossbeam-deque Data Race before v0.7.4 and v0.8.1

Impact In the affected version of this crate, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, th...

acto-rs (>=0.2.9, <=0.3.7), alumina (>=0.1.0, <=0.1.1) +337 more potentially affected by CVE-2018-25023 via smallvec (>=0.1.8, <=0.5.1)

smallvec CARGO version =0.1.8, =0.2.9, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.55 and more Source cves: CVE-2018-25023 Source advisory: OSV:GHSA-66P5-J55P-32R9...

bigbang (>=0.0.6, <=0.0.9), bruteforus (0.1.0) +8 more potentially affected by CVE-2020-36463 via multiqueue (0.3.2)

multiqueue CARGO version 0.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on multiqueue and may be impacted: - bigbang =0.0.6, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.1.6, =0.2.0, =0.5.0 Source cves: CVE-2020-36463 Source advisory:...

artillery-core (>=0.1.2-alpha.3, <=0.1.2), bastion (>=0.3.5, <=0.4.5) +489 more potentially affected by CVE-2021-38195 via libsecp256k1 (>=0.1.3, <=0.3.5)

libsecp256k1 CARGO version =0.1.3, =0.1.2-alpha.3, =0.3.5, =0.1.0, =0.1.1, =0.7.0, =0.1.0, =0.2.0, =1.0.0, =0.5.0, =0.8.2 and more Source cves: CVE-2021-38195 Source advisory: OSV:GHSA-G4VJ-X7V9-H82M...

amiwo (>=0.0.1, <=0.2.3), geoshaper (>=0.1.0, <=0.2.0) +8 more potentially affected by CVE-2021-29935 via rocket (>=0.1.6, <=0.2.11)

rocket CARGO version =0.1.6, =0.0.1, =0.1.0, =0.8.0, =0.15.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1 Source cves: CVE-2021-29935 Source advisory: OSV:GHSA-VCW4-8PH6-7VW8...

atomic-server (>=0.10.0, <=0.17.0), basic-http-server (>=0.6.0, <=0.8.1) +40 more potentially affected by CVE-2021-27671 via comrak (>=0.1.9, <=0.8.2)

comrak CARGO version =0.1.9, =0.10.0, =0.6.0, =0.1.0, =0.1.5, =0.1.0, =0.0.1, =0.15.0, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.1.7 and more Source cves: CVE-2021-27671 Source advisory: OSV:GHSA-XMR7-V725-2JJR...