CVE-2022-39397 Exposure of sensitive information in aliyun-oss-client

aliyun-oss-client is a rust client for Alibaba Cloud OSS. Users of this library will be affected, the incoming secret will be disclosed unintentionally. This issue has been patched in version 0.8.1...

Oracle Linux 9 : mingw-gcc (ELSA-2022-8415)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-8415 advisory. 12.0.1-11.2 - Bump release and rebuild resolves: rhbz2096010 12.0.1-11.1 - Rebase to Fedora Rawhide resolves: rhbz2080170 Tenable has extracted the preceding...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : sccache (SUSE-SU-2022:4073-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4073-1 advisory. Updated to version 0.3.0: - CVE-2022-24713: Fixed Regex denial of service bsc1196972. -...

SUSE SLES15 / openSUSE 15 Security Update : 389-ds (SUSE-SU-2022:4124-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:4124-1 advisory. - CVE-2021-45710: Fixed tokio data race with memory corruption bsc1194119. - Update to version 2.0.16git56.d15a0a7. - Failure ...

Hive Ransomware Attackers Extorted $100 Million from Over 1,300 Companies Worldwide

The threat actors behind the Hive ransomware-as-a-service RaaS scheme have launched attacks against over 1,300 companies across the world, netting the gang $100 million in illicit payments as of November 2022. "Hive ransomware has targeted a wide range of businesses and critical infrastructure...

AlmaLinux 9 : mingw-gcc (ALSA-2022:8415)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:8415 advisory. - GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial ...

CVE-2021-45710

A flaw was found in the tokio crate for Rust. In circumstances involving a closed oneshot channel, there is a data race and memory corruption issue...

SUSE SLES15 / openSUSE 15 Security Update : 389-ds (SUSE-SU-2022:3996-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3996-1 advisory. - CVE-2021-45710: Fixed tokio data race with memory corruption bsc1194119. - Update to version 2.0.16git56.d15a0a7: - Failure ...

gcc: uncontrolled recursion in libiberty/rust-demangle.c

A flaw was discovered in the GNU libiberty library within the demanglepath function in rust-demangle.c, as distributed in the GNU Compiler Collection GCC. This flaw allows a crafted symbol to cause stack memory to be exhausted, leading to a crash...

rust-coreos-installer bug fix and enhancement update

An update is available for rust-coreos-installer. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the...

keylime-agent-rust bug fix and enhancement update

An update is available for keylime-agent-rust. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

rust bug fix and enhancement update

An update is available for rust. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 9.1...

rust-ssh-key-dir bug fix and enhancement update

An update is available for rust-ssh-key-dir. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

rust-afterburn bug fix and enhancement update

An update is available for rust-afterburn. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Lin...

rust-toolset:rhel8 bug fix and enhancement update

An update is available for rust. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 8.7...

The Rise of Rust, the ‘Viral’ Secure Programming Language That’s Taking Over Tech

Rust makes it impossible to introduce some of the most common security vulnerabilities. And its adoption can’t come soon enough...

Design/Logic Flaw

conduit-hyper integrates a conduit application with the hyper server. Prior to version 0.4.2, conduit-hyper did not check any limit on a request's length before calling hyper::body::tobytes. An attacker could send a malicious request with an abnormally large Content-Length, which could lead to a...

conduit-hyper vulnerable to Denial of Service from unchecked request length

Prior to version 0.4.2, conduit-hyper did not check any limit on a request's length before calling hyper::body::tobytes. An attacker could send a malicious request with an abnormally large Content-Length, which could lead to a panic if memory allocation failed for that request. In version 0.4.2,...

CVE-2022-39294

CVE-2022-39294 affects conduit-hyper prior to 0.4.2, a Rust crate that integrates conduit with hyper. The root cause is that earlier versions did not enforce any limit on the request length before calling hyper::body::to_bytes, allowing an attacker to send a malicious request with an abnormally l...

CVE-2022-39354

SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the isstatic parameter to determine if the call is executed in a static context via STATICCALL, and thus decide if stateful operations should be done. Prior to version 0.36.0, th...