acme-client (>=0.1.0, <=0.2.0), aerial (0.1.0) +700 more potentially affected by CVE-2017-18589 via cookie (>=0.1.21, <=0.6.2)

cookie CARGO version =0.1.21, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.7.0, =0.1.0, =0.0.1, =0.0.1, =0.1.0, =0.5.0, =0.6.5 and more Source cves: CVE-2017-18589 Source advisory: OSV:GHSA-VJRQ-CG9X-RFJP...

CVE-2017-18589

CVE-2017-18589 affects the Rust cookie crate (pre-0.7.6). The issue arises from using time::Duration::seconds to parse Max-Age; very large integer values trigger a panic, potentially causing DoS. The Red Hat, Debian, GHSA, OSV, and RustSec records corroborate: the vulnerability is caused by Max-A...

CVE-2017-18589

An issue was discovered in the cookie crate before 0.7.6 for Rust. Large integers in the Max-Age of a cookie cause a panic...