MAL-2022-2912 Malicious code in example-rust (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ea3b88110c6d99f6f13c45a70f1a3a66f9c32da09f15db73f1a166c2cbfa080 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in example-rust (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ea3b88110c6d99f6f13c45a70f1a3a66f9c32da09f15db73f1a166c2cbfa080 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Use After Free in Context::start_auth_session

Impact This issue only applies to applications starting authorization sessions using an explicit initial nonce. When Context::startauthsession was called with a nonce argument value of Some..., the nonce pointer passed down through FFI to EsysStartAuthSession would be a dangling pointer, left ove...

GHSA-W3VW-CCC5-QR8V Use After Free in Context::start_auth_session

Impact This issue only applies to applications starting authorization sessions using an explicit initial nonce. When Context::startauthsession was called with a nonce argument value of Some..., the nonce pointer passed down through FFI to EsysStartAuthSession would be a dangling pointer, left ove...

GHSA-75RW-34Q6-72CR Signature forgery in Biscuit

Impact The paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level. As Biscu...

files (>=1.0.0, <=2.2.3), portal (>=2.0.0, <=3.0.1) potentially affected by CVE-2022-31053 via biscuit-auth (1.2.0)

biscuit-auth CARGO version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on biscuit-auth and may be impacted: - files =1.0.0, =2.0.0, =3.0.1 Source cves: CVE-2022-31053 Source advisory: OSV:GHSA-75RW-34Q6-72CR...

tremor-language-server (>=0.7.3, <=0.7.4) potentially affected by CVE-2021-45701 +1 more via tremor-script (0.7.2)

tremor-script CARGO version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on tremor-script and may be impacted: - tremor-language-server =0.7.3, =0.7.4 Source cves: CVE-2021-45701, CVE-2021-45702 Source advisory: OSV:GHSA-3PP4-64MP-9CG9...

buster (0.1.0), glog (0.1.0) +4 more potentially affected by unknown CVE via thread_local (1.0.1)

threadlocal CARGO version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on threadlocal and may be impacted: - buster 0.1.0 - glog 0.1.0 - simconnect 0.1.4 - skia-bindings =0.37.0, =0.37.0, =0.5.0, =0.5.1 Source cves: unknown CVE Source advisory:...

bencode (>=0.1.1, <=0.1.8), bincode (>=0.0.3, <=0.0.9) +49 more potentially affected by unknown CVE via rustc-serialize (>=0.1.5, <=0.3.22)

rustc-serialize CARGO version =0.1.5, =0.1.1, =0.0.3, =0.1.12, =0.1.2, =0.5.3, =0.5.2, =0.5.1, =0.1.4, =0.1.8, =0.6.41, =0.6.42 - docoptmacros 0.6.42 - email 0.0.9 - envelope 0.1.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-2226-4V3C-CFF8...

abstract-boot (>=0.2.0-beta.4, <=0.2.0-beta.7), ace-test-lib (0.1.0) +711 more potentially affected by unknown CVE via rust-crypto (0.2.36)

rust-crypto CARGO version 0.2.36 is affected by a known vulnerability. The following packages have a transitive dependency on rust-crypto and may be impacted: - abstract-boot =0.2.0-beta.4, =0.0.1, =0.0.1, =0.1.0, =0.0.1, =0.1.0, =0.2.0, =0.8.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0 and more...

Miscomputation when performing AES encryption in rust-crypto

The following Rust program demonstrates some strangeness in AES encryption - if you have an immutable key slice and then operate on that slice, you get different encryption output than if you operate on a copy of that key. For these functions, we expect that extending a 16 byte key to a 32 byte k...

GHSA-JP3W-3Q88-34CF Miscomputation when performing AES encryption in rust-crypto

The following Rust program demonstrates some strangeness in AES encryption - if you have an immutable key slice and then operate on that slice, you get different encryption output than if you operate on a copy of that key. For these functions, we expect that extending a 16 byte key to a 32 byte k...

alexcrichton-cranelift-native (>=0.52.0, <=0.53.0), alexcrichton-cranelift-simplejit (0.53.0) +153 more potentially affected by CVE-2021-45687 via raw-cpuid (>=3.1.0, <=8.1.2)

raw-cpuid CARGO version =3.1.0, =0.52.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.9.0, =0.26.1, =0.6.2, =0.5.0, =0.2.0, =0.5.1 and more Source cves: CVE-2021-45687 Source advisory: OSV:GHSA-JF5H-CF95-W759...

GHSA-JF5H-CF95-W759 Optional `Deserialize` implementations lacking validation

When activating the non-default feature serialize, most structs implement serde::Deserialize without sufficient validation. This allows breaking invariants in safe code, leading to: Undefined behavior in asstring methods which use std::str::fromutf8unchecked internally. Panics due to failed...

Optional `Deserialize` implementations lacking validation

When activating the non-default feature serialize, most structs implement serde::Deserialize without sufficient validation. This allows breaking invariants in safe code, leading to: Undefined behavior in asstring methods which use std::str::fromutf8unchecked internally. Panics due to failed...

A malicious coder can get unsound access to TCell or TLCell memory

This is impossible to do by accident, but by carefully constructing marker types to be covariant, a malicious coder can cheat the singleton check in TCellOwner and TLCellOwner, giving unsound access to cell memory. This could take the form of getting two mutable references to the same memory, or ...

GHSA-9C9F-7X9P-4WQP A malicious coder can get unsound access to TCell or TLCell memory

This is impossible to do by accident, but by carefully constructing marker types to be covariant, a malicious coder can cheat the singleton check in TCellOwner and TLCellOwner, giving unsound access to cell memory. This could take the form of getting two mutable references to the same memory, or ...

optra (>=0.1.0, <=0.2.1) potentially affected by CVE-2021-45694 via rdiff (0.1.2)

rdiff CARGO version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on rdiff and may be impacted: - optra =0.1.0, =0.2.1 Source cves: CVE-2021-45694 Source advisory: OSV:GHSA-Q579-9WP9-GFP2...

acid-store (>=0.8.0, <=0.11.2), alsa (0.5.1) +13 more potentially affected by CVE-2021-45707 via nix (0.21.0)

nix CARGO version 0.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on nix and may be impacted: - acid-store =0.8.0, =0.1.4, =0.1.4, =0.1.4, =4.0.0, =0.1.0-alpha.1, =0.1.2, =0.10.0, =1.4.10, =0.13.0-alpha.1, =0.0.8, =0.0.13 Source cves: CVE-2021-4570...

acid-store (>=0.2.0, <=0.11.2), acidalia (>=0.1.0, <=0.1.3) +1253 more potentially affected by CVE-2021-45707 via nix (>=0.16.1, <=0.20.0)

nix CARGO version =0.16.1, =0.2.0, =0.1.0, =0.1.0, =0.0.2, =4.3.1, =0.0.9, =0.1.0, =0.5.4-rc.1, =0.1.0, =0.5.0, =0.10.0, =0.13.0 - albedo 0.0.1-beta.0 and more Source cves: CVE-2021-45707 Source advisory: OSV:GHSA-WGRG-5H56-JG27...