CVE-2025-24898: Use After Free

rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions ssl::selectnextproto can return a slice pointing into the server argument's buffer but with a lifetime bound to the client argument. In situations where the sever buffer's lifetime is shorter than th...

rust-openssl Resource management error vulnerability

rust-openssl is a library from Rust for interacting with the OpenSSL library. A resource management error vulnerability exists in rust-openssl that stems from an incorrect return value lifecycle of the ssl::selectnextproto function, which could lead to the use of freed memory...

PT-2025-5595

Name of the Vulnerable Software and Affected Versions rust-openssl versions prior to 0.10.70 Description The issue arises when ssl::select next proto returns a slice pointing into the server argument's buffer but with a lifetime bound to the client argument. If the server buffer's lifetime is...

[SECURITY] Fedora 41 Update: rust-routinator-0.14.1-2.fc41

An RPKI relying party software...

Fedora 41 : rust-routinator (2025-bbabead4d7)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-bbabead4d7 advisory. New ASPA support is now always compiled in and available if enable-aspa is set. The aspa Cargo feature has been removed. 990 If merging mutliple ASPA objects...

CVE-2023-45853 affecting package rust for versions less than 1.72.0-5

CVE-2023-45853 affecting package rust for versions less than 1.72.0-5. A patched version of the package is available...

CBL Mariner 2.0 Security Update: cmake / curl / mysql / rust (CVE-2024-9681)

The version of cmake / curl / mysql / rust installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-9681 advisory. - When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent...

CVE-2025-24365

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwardenrs. Attacker can obtain owner rights of other organization. Hacker should know the ID of victim organization in real case the user can be a part of the organization as an unprivileged user and be...

CVE-2025-24365: Improper Access Control

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwardenrs. Attacker can obtain owner rights of other organization. Hacker should know the ID of victim organization in real case the user can be a part of the organization as an unprivileged user and be...

Important: rust

Issue Overview: libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to gitindexadd can cause heap corruption that could be leveraged for arbitrary code...

Amazon Linux AMI : rust (ALAS-2025-1956)

The version of rust installed on the remote host is prior to 1.68.2-1.66. It is, therefore, affected by a vulnerability as referenced in the ALAS-2025-1956 advisory. libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build G...

CVE-2025-22620

gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. Thi...

UBUNTU-CVE-2025-22620

gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. Thi...

CVE-2025-22620

Summary: CVE-2025-22620 affects gitoxide’s gix-worktree-state, where one checkout strategy can apply 0777 permissions to executable files in Unix-like systems, bypassing the umask and potentially making files world-writable. This occurs in the checkout logic depending on destination_is_initially_...

CVE-2025-22620

gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. Thi...

CVE-2025-22620: Improper Preservation of Permissions

gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. Thi...

GitOxide security vulnerabilities

gitoxide is a git implementation written in Rust by the individual developer Sebastian Thiel. A security vulnerability exists in gitoxide versions prior to 0.17.0, which stems from the fact that files in the repository are globally writable under certain circumstances...

GHSA-C873-WFHP-WX5M SP1 has missing verifier checks and fiat-shamir observations

In SP1’s STARK verifier, the prover provided chipordering is used to fetch the index of the chips that have preprocessed columns. Prior to v4.0.0, the validation that this chipordering correctly provides these indexes was missing. In v4.0.0, this was fixed by adding a check that the indexed chip’...

SP1 has missing verifier checks and fiat-shamir observations

In SP1’s STARK verifier, the prover provided chipordering is used to fetch the index of the chips that have preprocessed columns. Prior to v4.0.0, the validation that this chipordering correctly provides these indexes was missing. In v4.0.0, this was fixed by adding a check that the indexed chip’...

acct (>=0.2.0, <=0.5.0), almel (>=1.0.0, <=1.4.7) +179 more potentially affected by CVE-2025-5791 via users (>=0.8.1, <=0.11.0)

users CARGO version =0.8.1, =0.2.0, =1.0.0, =0.1.0, =0.9.0, =0.9.0, =0.1.0, =0.9.0, =0.2.4, =0.1.0, =0.4.2, =0.4.0, =0.7.4, =0.1.4, =0.8.2, =0.8.3 and more Source cves: CVE-2025-5791 Source advisory: OSV:RUSTSEC-2025-0040...