12399 matches found
gpiocdev (>=0.4.3, <=0.7.0), gpiocdev-embedded-hal (0.1.0) +1 more potentially affected by CVE-2024-51756 via cap-primitives (3.0.0)
cap-primitives CARGO version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cap-primitives and may be impacted: - gpiocdev =0.4.3, =0.16.0, =0.16.3 Source cves: CVE-2024-51756 Source advisory: OSV:RUSTSEC-2024-0445...
CVE-2024-51502 Panic Vulnerability in loona-hpack
loona is an experimental, HTTP/1.1 and HTTP/2 implementation in Rust on top of io-uring. loona-hpack suffers from the same vulnerability as the original hpack as documented in issue 11. All users who try to decode untrusted input using the Decoder are vulnerable to this exploit. This issue has be...
CVE-2024-51502
CVE-2024-51502 affects loona-hpack (Rust, built on io-uring) where the Decoder can be exploited by decoding untrusted input. The vulnerability is the same as in the original hpack and is mitigated by upgrading to loona release 0.4.3. Connected sources also reference a patched crate (hpack-patched...
CVE-2024-51502 Panic Vulnerability in loona-hpack
loona is an experimental, HTTP/1.1 and HTTP/2 implementation in Rust on top of io-uring. loona-hpack suffers from the same vulnerability as the original hpack as documented in issue 11. All users who try to decode untrusted input using the Decoder are vulnerable to this exploit. This issue has be...
CVE-2024-51502 Panic Vulnerability in loona-hpack
loona is an experimental, HTTP/1.1 and HTTP/2 implementation in Rust on top of io-uring. loona-hpack suffers from the same vulnerability as the original hpack as documented in issue 11. All users who try to decode untrusted input using the Decoder are vulnerable to this exploit. This issue has be...
CVE-2024-51502: Improper Handling of Exceptional Conditions
loona is an experimental, HTTP/1.1 and HTTP/2 implementation in Rust on top of io-uring. loona-hpack suffers from the same vulnerability as the original hpack as documented in issue 11. All users who try to decode untrusted input using the Decoder are vulnerable to this exploit. This issue has be...
WS-2023-0172
The NATS official Rust clients are vulnerable to MitM when using TLS. A fix for the nats crate hasn't been released yet. Since the nats crate is going to be deprecated anyway, consider switching to async-nats = 0.29 which already fixed this vulnerability. The common name of the server's TLS...
WS-2022-0242
All versions of owningref in Rust have multiple soundness issues that may result in a use-after free. The crate violates Rust's aliasing rules, which may cause miscompilations on recent compilers that emit the LLVM noalias attribute...
WS-2022-0262
A practical key-recovery attack against Rainbow was found in liboqs on Rust through 0.7.1. This means all the oqs::sig::Algorithm::RainbowI variants are insecure. The level I parametersets are removed from liboqs starting from version 0.7.2...
WS-2022-0261
In oqs 0.7.1 in Rust, there is an efficient key recovery attack on the SIDH protocol. As a result, the secret key of SIKEp751 can be recovered in a matter of hours. The affected schemes are the oqs::kem::Algorithm::Sike and oqs::kem::Algorithm::Sidh enum variants. The SIKE and SIDH schemes will b...
WS-2021-0634
A memory safety issue was found in mz-avro in Rust. Arbitrary Read implementations can read from the uninitialized buffer and also can return an incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior...
WS-2022-0064
RUST for windows before 0.32.0 did not require event handlers to have Send bound despite there being no guarantee of them being called on any particular thread, which can potentially lead to data races and undefined behavior...
WS-2020-0444
All versions of shamir rust crate before 2.0.0 did not properly calculate secret shares requirements. This reduces the security of the shamir secret sharing algorithm by restricting the crate to always using a threshold value of three, rather than a configurable limit...
WS-2022-0158
rust-crypto demonstrates some strangeness in AES encryption - If you have an immutable key slice and then operate on that slice, you get different encryption output than if you operate on a copy of that key. This may result in the exposure of sensitive information...
WS-2023-0320
Affected versions allow arbitrary caller-provided code to execute before the lifetime of main. If the caller-provided code accesses particular pieces of the standard library that require an initialized Rust runtime, such as std::io or std::thread, these may not behave as documented. Panics are...
WS-2022-0155
In arrow2 in Rust, the struct FfiArrowArray implements deriveClone that is inconsistent with its custom implementation of Drop, resulting in a double free when cloned. Cloning this struct in safe results in a segmentation fault, which is unsound. Versions 0.7.1, 0.8.2 and 0.9.2 contain a patch fo...
WS-2022-0321
personnummer/rust vulnerThis vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure.able to Improper Input Validation...
openSUSE: Security Advisory for 389 (SUSE-SU-2024:3843-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
openSUSE: Security Advisory for 389 (SUSE-SU-2024:3844-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
