Rust-WebSocket 资源管理错误漏洞

Rust-WebSocket is a Rust-based WebSocket library. A resource management error vulnerability exists in Rust-WebSocket versions prior to 0.26.5, which stems from the fact that an untrusted websocket connection may cause an out-of-memory OOM process to abort on the client or server. The root cause o...

graphql-rust 资源管理错误漏洞

graphql-rust is a Rust-based GraphQL server library. A resource management error vulnerability exists in versions of graphql-rust Juniper prior to 0.15.10, which stems from vulnerability to uncontrolled recursion that can cause a program to crash...

automaat-processor-git-clone (0.1.0), automaat-processor-http-request (0.1.0) +50 more potentially affected by CVE-2022-31173 via juniper (>=0.7.0, <=0.15.8)

juniper CARGO version =0.7.0, =0.3.0-development-1, =0.3.0-development-1, =0.3.0-development-1, =0.3.0-development-1, =0.3.0-development-2 and more Source cves: CVE-2022-31173 Source advisory: OSV:GHSA-4RX6-G5VG-5F3J...

automaat-processor-git-clone (0.1.0), automaat-processor-http-request (0.1.0) +50 more potentially affected by CVE-2022-31173 via juniper (>=0.7.0, <=0.15.8)

juniper CARGO version =0.7.0, =0.3.0-development-1, =0.3.0-development-1, =0.3.0-development-1, =0.3.0-development-1, =0.3.0-development-2 and more Source cves: CVE-2022-31173 Source advisory: OSV:RUSTSEC-2022-0038...

Information disclosure

Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the possibility of printing sensitive...

auto-wasi (0.1.0), ceres-executor (>=0.1.0, <=0.2.0) +82 more potentially affected by CVE-2022-23636 +1 more via wasmtime (>=0.7.0, <=0.37.0)

wasmtime CARGO version =0.7.0, =0.1.0, =0.1.1, =0.5.3-0, =0.4.0-pre, =0.4.0-pre, =0.0.0, =0.40.1, =0.45.0, =0.10.0, =0.1.0, =0.1.0, =0.3.0 - inkpad-executor 0.1.0 and more Source cves: CVE-2022-23636, CVE-2022-31169 Source advisory: OSV:GHSA-7F6X-JWH5-M9R4...

abstraps (0.1.8), aivm (>=0.2.0, <=0.3.0) +287 more potentially affected by CVE-2022-23636 +1 more via cranelift-codegen (>=0.14.0, <=0.84.0)

cranelift-codegen CARGO version =0.14.0, =0.2.0, =0.1.0, =0.1.0, =0.5.0, =0.1.0, =0.1.0, =0.2.9, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.26.1, =0.30.1 and more Source cves: CVE-2022-23636, CVE-2022-31169 Source advisory: OSV:GHSA-7F6X-JWH5-M9R4...

CVE-2022-31162 Slack Morphism for Rust before 0.41.0 can accidentally leak Slack OAuth client information in application debug logs

Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the possibility of printing sensitive...

CVE-2022-31162 Slack Morphism for Rust before 0.41.0 can accidentally leak Slack OAuth client information in application debug logs

Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the possibility of printing sensitive...

CVE-2022-31162

CVE-2022-31162 affects Slack Morphism (Rust) prior to 0.41.0. The root issue was overly verbose debug formatting that could cause Slack OAuth client information to leak into application logs. Exploitation guidance is not provided in the documents; however, various sources confirm an information d...

cranelift (0.84.0), cranelift-frontend (0.84.0) +19 more potentially affected by CVE-2022-31146 via cranelift-codegen (0.84.0)

cranelift-codegen CARGO version 0.84.0 is affected by a known vulnerability. The following packages have a transitive dependency on cranelift-codegen and may be impacted: - cranelift 0.84.0 - cranelift-frontend 0.84.0 - cranelift-interpreter 0.84.0 - cranelift-jit 0.84.0 - cranelift-module 0.84.0...

Google Adds Support for DNS-over-HTTP/3 in Android to Keep DNS Queries Private — The Hacker News

Google on Tuesday officially announced support for DNS-over-HTTP/3 DoH3 for Android devices as part of a Google Play system update designed to keep DNS queries private. To that end, Android smartphones running Android 11 and higher are expected to use DoH3 instead of DNS-over-TLS DoT, which was...

Luna and Black Basta — new ransomware for Windows, Linux and ESXi

Introduction In our crimeware reporting service, we analyze the latest crime-related trends we come across. If we look back at what we covered last month, we will see that ransomware surprise, surprise! definitely stands out. In this blog post, we provide several excerpts from last months reports...

Slack Morphism for Rust before 0.41.0 can leak Slack OAuth client information in application debug logs

Impact Potential/accidental leaking of Slack OAuth client information in application debug logs. Patches More strict and secure debug formatting was introduced in v0.41 for OAuth secret types to avoid the possibility of printing sensitive information in application logs. Workarounds Don't...

slack-morphism-hyper (>=0.5.0, <=0.40.0), slack-paste (0.1.0) potentially affected by CVE-2022-31162 via slack-morphism (>=0.2.8, <=0.40.0)

slack-morphism CARGO version =0.2.8, =0.5.0, =0.40.0 - slack-paste 0.1.0 Source cves: CVE-2022-31162 Source advisory: OSV:GHSA-99J7-MHFH-W84P...

GHSA-99J7-MHFH-W84P Slack Morphism for Rust before 0.41.0 can leak Slack OAuth client information in application debug logs

Impact Potential/accidental leaking of Slack OAuth client information in application debug logs. Patches More strict and secure debug formatting was introduced in v0.41 for OAuth secret types to avoid the possibility of printing sensitive information in application logs. Workarounds Don't...

Medium: rust

Issue Overview: In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed or the program to crash if the borrowed string changes after its length is checked. CVE-2020-36323 In the standard library in Rust before...

Medium: rust

Issue Overview: A race condition flaw was found in Rust's std::fs::removedirall function. Rust applications that use this function may be vulnerable to a race condition where an unprivileged attacker can trick the application into deleting files and directories, causing an impact on system data...

Amazon Linux 2 : rust (ALAS-2022-1816)

The version of rust installed on the remote host is prior to 1.56.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1816 advisory. In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized byt...

Amazon Linux 2 : rust (ALAS-2022-1817)

The version of rust installed on the remote host is prior to 1.61.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1817 advisory. A race condition flaw was found in Rust's std::fs::removedirall function. Rust applications that use this function may be vulnerable ...