RUSTSEC-2023-0002 git2 Rust package suppresses ssh host key checking

By default, when accessing an ssh repository ie via an ssh: git repository url the git2 Rust package does not do any host key checking. Additionally, the provided API is not sufficient for a an application to do meaningful checking itself. Impact When connecting to an ssh repository, and when an...

Design/Logic Flaw

Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle MITM attacks. This vulnerability has been assigned...

CVE-2022-46176 Cargo did not verify SSH host keys

Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle MITM attacks. This vulnerability has been assigned...

AZL-35235 CVE-2022-35256 affecting package rust for versions less than 1.75.0-1

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling...

GHSA-QQFF-4VW4-F6HX Cap'n Proto and its Rust implementation vulnerable to out-of-bounds read due to logic error handling list-of-list

The Cap'n Proto library and capnp Rust package are vulnerable to out-of-bounds read due to logic error handling list-of-list. If a message consumer expects data of type "list of pointers", and if the consumer performs certain specific actions on such data, then a message producer can cause the...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : rust1.62 (SUSE-SU-2022:3451-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3451-1 advisory. - CVE-2022-36113: Fixed symlink hijack vulnerability bsc1203433. - CVE-2022-36114: Fixed zip bom...

CVE-2022-36113 Extracting malicious crates can corrupt arbitrary files

Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the /.cargo folder on disk, making it available to the Rust projects it builds. To record when an extraction is successful, Cargo writes "ok" to the .cargo-ok file at the...

AZL-40893 CVE-2022-32214 affecting package rust for versions less than 1.75.0-1

The llhttp parser v14.20.1, v16.17.1 and v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS...

AZL-41446 CVE-2022-32215 affecting package rust for versions less than 1.75.0-1

The llhttp parser v14.20.1, v16.17.1 and v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling HRS...

AZL-41093 CVE-2022-1201 affecting package rust for versions less than 1.75.0-1

NULL Pointer Dereference in mrbvmexec with super in GitHub repository mruby/mruby prior to 3.2. This vulnerability is capable of making the mruby interpreter crash, thus affecting the availability of the system...

CVE-2020-36318 affecting package rust 1.47.0-2

CVE-2020-36318 affecting package rust 1.47.0-2. An upgraded version of the package is available that resolves this issue...

AZL-41766 CVE-2022-0890 affecting package rust for versions less than 1.75.0-1

NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2...

AZL-41314 CVE-2022-0632 affecting package rust for versions less than 1.75.0-1

NULL Pointer Dereference in Homebrew mruby prior to 3.2...

Mageia: Security Advisory (MGASA-2022-0044)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Photon OS 3.0: Rust PHSA-2021-3.0-0324

An update of the rust package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0324. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descriptio...

Critical Photon OS Security Update - PHSA-2021-0122

Updates of 'rust' packages of Photon OS have been released...

Photon OS 3.0: Rust PHSA-2021-3.0-0288

An update of the rust package has been released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0288. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc...

SUSE: Security Advisory (SUSE-SU-2018:3357-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

efw (=0.1.0) potentially affected by CVE-2020-36209 via late-static (=0.3.0)

late-static CARGO version =0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on late-static and may be impacted: - efw =0.1.0 Source cves: CVE-2020-36209 Source advisory: OSV:RUSTSEC-2020-0102...

openSUSE: Security Advisory for rust (openSUSE-SU-2019:2203-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...