CVE-2021-27376

An issue was discovered in the nb-connect crate before 1.0.3 for Rust. It may have invalid memory access for certain versions of the standard library because it relies on a direct cast of std::net::SocketAddrV4 and std::net::SocketAddrV6 data structures...

CVE-2021-27376

CVE-2021-27376 affects the Rust crate nb-connect , file/socket handling. The issue arises from a direct cast of std::net::SocketAddrV4 and SocketAddrV6, relying on the wrong assumption about memory layout, which can lead to invalid memory access. The Red Hat and GHSA/RustSec entries confirm the r...

CVE-2021-27377

CVE-2021-27377 affects the yottadb crate for Rust, specifically versions before 1.2.0. The vulnerability is a use-after-free in memory handling for certain allocation patterns, involving ydb_subscript_next_st and ydb_subscript_prev_st. Multiple connected advisories (e.g., RUSTSEC-2021-0022, GHSA-...

CVE-2021-27378

An issue was discovered in the randcore crate before 0.6.2 for Rust. Because readu32into and readu64into mishandle certain buffer-length checks, a random number generator may be seeded with too little data...

CVE-2021-27378

The CVE-2021-27378 issue affects the rand_core crate prior to 0.6.2 for Rust. The root cause is mishandling in read_u32_into and read_u64_into that can lead to a random number generator being seeded with insufficient data, enabling an improper seed condition. Public references in the connected do...

CVE-2021-27378

An issue was discovered in the randcore crate before 0.6.2 for Rust. Because readu32into and readu64into mishandle certain buffer-length checks, a random number generator may be seeded with too little data...

Rust nb-connect buffer error vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust nb-connect. The vulnerability stems from a forced data type conversion using std::net::SocketAddrV4 and std::net::SocketAddrV6 in some versions of the standard library,...

Rust yottadb Resource Management Error Vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A resource management error vulnerability exists in Rust yottadb. The vulnerability stems from an error in the memory allocation mode causing memory to remain available after it has been freed by the...

Rust rand_core Security Feature Issue Vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security signature vulnerability exists in Rust randcore, which is caused by readu32into and readu64into mishandling buffer length checks, and can be exploited to cause a buffer overflow or heap overflow. The...

rust-toolset:rhel8 bug fix and enhancement update

Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, the cargo-vendor plugin, and required libraries. Rust Toolset has been updated to version 1.47.0 BZ1883839. For detailed information on changes in this release, see the AlmaLinux.1...

CVE-2021-21299

hyper is an open-source HTTP library for Rust crates.io. In hyper from version 0.12.0 and before versions 0.13.10 and 0.14.3 there is a vulnerability that can enable a request smuggling attack. The HTTP server code had a flaw that incorrectly understands some requests with multiple...

CVE-2021-21299

hyper is an open-source HTTP library for Rust crates.io. In hyper from version 0.12.0 and before versions 0.13.10 and 0.14.3 there is a vulnerability that can enable a request smuggling attack. The HTTP server code had a flaw that incorrectly understands some requests with multiple...

Design/Logic Flaw

hyper is an open-source HTTP library for Rust crates.io. In hyper from version 0.12.0 and before versions 0.13.10 and 0.14.3 there is a vulnerability that can enable a request smuggling attack. The HTTP server code had a flaw that incorrectly understands some requests with multiple...

UBUNTU-CVE-2021-21299

hyper is an open-source HTTP library for Rust crates.io. In hyper from version 0.12.0 and before versions 0.13.10 and 0.14.3 there is a vulnerability that can enable a request smuggling attack. The HTTP server code had a flaw that incorrectly understands some requests with multiple...

CVE-2021-21299

CVE-2021-21299 affects the Rust HTTP library hyper. The vulnerability resides in hyper’s HTTP server code, which may misinterpret requests with multiple Transfer-Encoding headers, potentially treating the payload as chunked when it should be illegal. Exploitation requires three conditions to be m...

CVE-2021-21299 Multiple Transfer-Encoding headers misinterprets request payload

hyper is an open-source HTTP library for Rust crates.io. In hyper from version 0.12.0 and before versions 0.13.10 and 0.14.3 there is a vulnerability that can enable a request smuggling attack. The HTTP server code had a flaw that incorrectly understands some requests with multiple...

hyper crate for Rust environment issue vulnerability

hyper crate for Rust is a Rust-based HTTP library. An environmental issue vulnerability exists in hyper crate for Rust that arises from an unreasonable environmental factor in a networked system or product...

CVE-2021-26957

An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because there is an out-of-bounds read in xcb::xproto::changeproperty, as demonstrated by a format=32 T=u8 situation where out-of-bounds bytes are sent to an X server...

CVE-2021-26958

An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because transmutation to the wrong type can happen after xcb::base::castevent uses std::mem::transmute to return a reference to an arbitrary type...

CVE-2021-26958

An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because transmutation to the wrong type can happen after xcb::base::castevent uses std::mem::transmute to return a reference to an arbitrary type...