RUSTSEC-2023-0100 `xrvrv` was removed from crates.io for malicious code

This crate was part of a typosquatting malware cluster published by the malicious user amaperf and contained a malware payload in build.rs to exfiltrate host information to the attacker. This advisory is to retrospectively document this attempted attack. The version information and download recor...

`serd` was removed from crates.io for malicious code

This crate was part of a typosquatting malware cluster published by the malicious user amaperf and contained a malware payload in build.rs to exfiltrate host information to the attacker. This advisory is to retrospectively document this attempted attack. The version information and download recor...

`postgress` was removed from crates.io for malicious code

This crate was part of a typosquatting malware cluster published by the malicious user amaperf and contained a malware payload in build.rs to exfiltrate host information to the attacker. This advisory is to retrospectively document this attempted attack. The version information and download recor...

`if-cfg` was removed from crates.io for malicious code

This crate was part of a typosquatting malware cluster published by the malicious user amaperf and contained a malware payload in build.rs to exfiltrate host information to the attacker. This advisory is to retrospectively document this attempted attack. The version information and download recor...

`xrvrv` was removed from crates.io for malicious code

This crate was part of a typosquatting malware cluster published by the malicious user amaperf and contained a malware payload in build.rs to exfiltrate host information to the attacker. This advisory is to retrospectively document this attempted attack. The version information and download recor...

`envlogger` was removed from crates.io for malicious code

This crate was part of a typosquatting malware cluster published by the malicious user amaperf and contained a malware payload in build.rs to exfiltrate host information to the attacker. This advisory is to retrospectively document this attempted attack. The version information and download recor...

NT-anchor-spl (>=0.19.0 <=0.19.5), NT-anchor-spl-testnet (=0.19.2) +1606 more potentially affected by CVE-2022-50237 via ed25519-dalek (>=0.9.1 <=2.0.0-pre.0)

ed25519-dalek CARGO version =0.9.1, =0.19.0, =0.4.2, =0.2.0-beta.4, =0.1.0, =0.1.1, =0.1.0, =1.0.5, =0.0.0-alpha, =0.0.1-alpha.1, =0.5.0, =0.5.2, =0.8.0, =0.8.0, =0.8.9 and more Source cves: CVE-2022-50237 Source advisory: OSV:GHSA-W5VR-6QHR-36CC...

RustLibrary (>=0.1.0 <=0.2.0), RustyBox (=0.1.0) +411 more potentially affected by unknown CVE via tui (>=0.10.0 <=0.9.5)

tui CARGO version =0.10.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.2, =0.1.6, =0.1.0, =0.1.0, =0.0.9, =0.1.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0049...

Use-after-free in `vec_insert_bytes`

Incorrect reallocation logic in the function vecinsertbytes causes a use-after-free. This function does not have to be called directly to trigger the vulnerability because many methods on EncodingWriter call this function internally. The mail-\ suite is unmaintained and the upstream sources have...

DEBIAN-CVE-2023-38497

Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local...

UBUNTU-CVE-2023-38497

Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local...

anchor-client (=0.26.0), basejmp (=0.1.0) +251 more potentially affected by unknown CVE via dlopen_derive (=0.1.4)

dlopenderive CARGO version =0.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on dlopenderive and may be impacted: - anchor-client =0.26.0 - basejmp =0.1.0 - bonfida-test-utils =0.1.0 - bonfida-utils =0.2.3, =0.2.0, =1.0.4, =2.0.16, =1.4.2, =1.3.0,...

GetPDB (>=0.1.0 <=1.0.1), IMAPServer (=0.1.0) +4086 more potentially affected by unknown CVE via memoffset (>=0.1.0 <=0.5.6)

memoffset CARGO version =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.1.0, =0.1.0, =0.8.0, =0.4.0, =0.5.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WFG4-322G-9VQV...

GetPDB (>=0.1.0 <=1.0.1), IMAPServer (=0.1.0) +4086 more potentially affected by unknown CVE via memoffset (>=0.1.0 <=0.5.6)

memoffset CARGO version =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.1.0, =0.1.0, =0.8.0, =0.4.0, =0.5.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0045...

bitcoin-harness (=0.1.0), bitcoin_rpc_client (>=0.5.0 <=0.6.1) +78 more potentially affected by CVE-2023-53159 via openssl (>=0.10.22 <=0.10.52)

openssl CARGO version =0.10.22, =0.5.0, =0.2.0, =0.0.0, =0.0.1, =0.3.3, =0.6.25, =0.1.0-alpha.0, =0.1.24, =0.37.0, =0.4.0, =0.37.0, =0.37.0, =0.38.0 and more Source cves: CVE-2023-53159 Source advisory: OSV:RUSTSEC-2023-0044...

cyfs-chunk-lib (=0.5.0), cyfs-cip (>=0.5.0 <=0.6.4) +1 more potentially affected by unknown CVE via cyfs-base (>=0.5.5 <=0.6.12)

cyfs-base CARGO version =0.5.5, =0.5.0, =0.6.4 - cyfs-core =0.5.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0046...

abel (>=0.1.0 <=0.1.1), abel-core (>=0.1.0 <=0.1.1) +311 more potentially affected by unknown CVE via ouroboros (>=0.10.1 <=0.15.6)

ouroboros CARGO version =0.10.1, =0.1.0, =0.1.0, =0.4.0, =0.4.0, =0.4.0, =0.1.0, =1.1.0, =0.6.0, =0.1.0, =0.1.1, =0.3.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0042...

libpijul (>=0.12.0 <=0.12.1), pijul (>=0.12.0 <=0.12.1) +7 more potentially affected by CVE-2023-53161 via buffered-reader (>=0.11.0 <=0.5.0)

buffered-reader CARGO version =0.11.0, =0.12.0, =0.12.0, =0.1.0, =0.1.0, =0.17.0, =0.2.0, =0.0.1, =0.1.0, =0.4.0 Source cves: CVE-2023-53161 Source advisory: OSV:GHSA-29MF-62XX-28JQ...

csaf-walker (=0.1.0), did-webkey (=0.1.1) +24 more potentially affected by CVE-2023-53160 via sequoia-openpgp (>=0.11.0 <=1.17.0)

sequoia-openpgp CARGO version =0.11.0, =0.3.0, =0.12.0, =0.12.0, =0.25.0, =0.1.0, =0.30.0, =0.1.0, =0.1.0, =0.1.0, =0.6.0 - sequoia-keystore-openpgp-card =0.1.1 and more Source cves: CVE-2023-53160 Source advisory: OSV:GHSA-25MX-8F3V-8WH7...

acct (>=0.2.0 <=0.5.0), acid-store (>=0.8.0 <=0.14.2) +278 more potentially affected by unknown CVE via users (>=0.10.0 <=0.9.1)

users CARGO version =0.10.0, =0.2.0, =0.8.0, =0.4.0, =4.1.0, =0.1.0, =1.0.0, =0.1.0, =0.9.0, =0.9.0, =0.1.0, =0.6.2, =0.9.0, =0.2.4, =0.1.0, =0.4.51 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0040...