Regular expression denial of service in Rust's regex crate

...

An issue was discovered in the nalgebra crate before 0.27.1 for Rust. It allows out-of-bounds memory access because it does not ensure that the number of elements is equal to the product of the row count and column count.

...

Rust-Based P2PInfect Botnet Evolves with Miner and Ransomware Payloads

The peer-to-peer malware botnet known as P2PInfect has been found targeting misconfigured Redis servers with ransomware and cryptocurrency miners. The development marks the threat's transition from what appeared to be a dormant botnet with unclear motives to a financially motivated operation. "Wi...

btctax-store (>=0.1.0, <=0.18.0), pep_engine_sequoia_backend (1.1.0) +7 more potentially affected by CVE-2024-58261 via sequoia-openpgp (>=1.14.0, <=1.17.0)

sequoia-openpgp CARGO version =1.14.0, =0.1.0, =0.25.0, =0.1.0, =0.1.0, =0.2.0, =0.4.0-rc.1, =4.1.1 Source cves: CVE-2024-58261 Source advisory: OSV:GHSA-9344-P847-QM5C...

a2d (>=0.1.0, <=0.1.11), abstract-adapter-utils (>=0.16.0, <=0.19.2) +2457 more potentially affected by unknown CVE via derivative (>=1.0.4, <=2.2.0)

derivative CARGO version =1.0.4, =0.1.0, =0.16.0, =0.1.0-rc.2, =0.0.1, =0.1.0-rc.2, =0.2.0-beta.4, =0.2.0-beta.4, =0.0.1, =0.0.1, =0.0.1, =0.1.0-rc.1, =0.0.1, =0.14.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0388...

btctax-store (>=0.1.0, <=0.18.0), pep_engine_sequoia_backend (1.1.0) +7 more potentially affected by CVE-2024-58261 via sequoia-openpgp (>=1.14.0, <=1.17.0)

sequoia-openpgp CARGO version =1.14.0, =0.1.0, =0.25.0, =0.1.0, =0.1.0, =0.2.0, =0.4.0-rc.1, =4.1.1 Source cves: CVE-2024-58261 Source advisory: OSV:RUSTSEC-2024-0345...

atuin (>=0.3.0, <=0.4.0), bibliographix (>=0.1.0, <=0.6.0) +19 more potentially affected by unknown CVE via chrono-english (0.1.8)

chrono-english CARGO version 0.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on chrono-english and may be impacted: - atuin =0.3.0, =0.1.0, =1.9.0, =0.2.0, =0.1.0, =0.4.2, =0.4.0, =0.0.4, =0.1.0, =0.1.0, =0.1.0, =0.10.0, =0.12.2 and more Source cves...

CVE-2022-35256 affecting package rust for versions less than 1.75.0-1

CVE-2022-35256 affecting package rust for versions less than 1.75.0-1. A patched version of the package is available...

CVE-2022-32215 affecting package rust for versions less than 1.75.0-1

CVE-2022-32215 affecting package rust for versions less than 1.75.0-1. A patched version of the package is available...

CVE-2022-0890 affecting package rust for versions less than 1.75.0-1

CVE-2022-0890 affecting package rust for versions less than 1.75.0-1. A patched version of the package is available...

CVE-2022-0632 affecting package rust for versions less than 1.75.0-1

CVE-2022-0632 affecting package rust for versions less than 1.75.0-1. A patched version of the package is available...

CVE-2022-1201 affecting package rust for versions less than 1.75.0-1

CVE-2022-1201 affecting package rust for versions less than 1.75.0-1. A patched version of the package is available...

CVE-2022-32214 affecting package rust for versions less than 1.75.0-1

CVE-2022-32214 affecting package rust for versions less than 1.75.0-1. A patched version of the package is available...

CVE-2024-28182 affecting package rust for versions less than 1.75.0-1

CVE-2024-28182 affecting package rust for versions less than 1.75.0-1. A patched version of the package is available...

CVE-2022-0326 affecting package rust for versions less than 1.75.0-1

CVE-2022-0326 affecting package rust for versions less than 1.75.0-1. A patched version of the package is available...

CVE-2022-0614 affecting package rust for versions less than 1.75.0-1

CVE-2022-0614 affecting package rust for versions less than 1.75.0-1. A patched version of the package is available...

New Rust-based Fickle Malware Uses PowerShell for UAC Bypass and Data Exfiltration

A new Rust-based information stealer malware called Fickle Stealer has been observed being delivered via multiple attack chains with the goal of harvesting sensitive information from compromised hosts. Fortinet FortiGuard Labs said it's aware of four different distribution methods -- namely VBA...

Rust Git Path Traversal DoS

The vulnerability of the Rust library for working with Git repositories like gitoxide is related to shortcomings in the path name checking process for Windows. Exploiting this vulnerability could allow a malicious actor to cause service failures...

aucpace (0.1.0), bacteria (0.0.9) +17 more potentially affected by CVE-2024-58262 via curve25519-dalek (>=4.0.0-pre.1, <=4.1.0)

curve25519-dalek CARGO version =4.0.0-pre.1, =0.5.0, =0.9.0-rc.0, =1.4.6, =2.0.0-pre.0, =0.1.0, =0.1.0, =0.1.0, =0.3.7, =2.0.0-pre.2, =0.9.1, =0.9.2 - ssh-key 0.6.0-pre.0 and more Source cves: CVE-2024-58262 Source advisory: OSV:GHSA-X4GP-PQPJ-F43Q...

aucpace (0.1.0), bacteria (0.0.9) +17 more potentially affected by CVE-2024-58262 via curve25519-dalek (>=4.0.0-pre.1, <=4.1.0)

curve25519-dalek CARGO version =4.0.0-pre.1, =0.5.0, =0.9.0-rc.0, =1.4.6, =2.0.0-pre.0, =0.1.0, =0.1.0, =0.1.0, =0.3.7, =2.0.0-pre.2, =0.9.1, =0.9.2 - ssh-key 0.6.0-pre.0 and more Source cves: CVE-2024-58262 Source advisory: OSV:RUSTSEC-2024-0344...