curve25519-dalek crate security vulnerabilities

curve25519-dalek crate is a Rust library from dalek cryptography open source. A security vulnerability exists in curve25519-dalek crate versions prior to 4.1.3, which stems from the possibility of disclosing private keys and other secrets...

CVE-2023-53156: Integer Overflow or Wraparound

The transpose crate before 0.2.3 for Rust allows an integer overflow via inputwidth and inputheight arguments...

CVE-2024-58261

The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertParser operations that encounter an unsupported primary key type...

CVE-2024-58262

The curve25519-dalek crate before 4.1.3 for Rust has a constant-time operation on elliptic curve scalars that is removed by LLVM...

CVE-2024-58261

The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertParser operations that encounter an unsupported primary key type...

CVE-2024-58266

The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the and \xa0 characters, which may facilitate command injection...

CVE-2024-58265

The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery...

CVE-2024-58265

The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery...

CVE-2024-58266: Improper Encoding or Escaping of Output

The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the and \xa0 characters, which may facilitate command injection...

CVE-2023-53157

CVE-2023-53157 affects the Rosenpass crate for Rust; versions before 0.2.1 are vulnerable. A crafted single-byte UDP packet can trigger a panic, enabling remote attackers to cause a denial of service. The available connected and primary sources consistently describe this behavior and impact as a ...

CVE-2023-53157

The rosenpass crate before 0.2.1 for Rust allows remote attackers to cause a denial of service panic via a one-byte UDP packet...

CVE-2024-58261: Loop with Unreachable Exit Condition

The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertParser operations that encounter an unsupported primary key type...

NewStart CGSL MAIN 7.02 : rust Vulnerability (NS-SA-2025-0146)

The remote NewStart CGSL host, running version MAIN 7.02, has rust packages installed that are affected by a vulnerability: - Cargo downloads the Rust project's dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the uma...

MAL-2025-6299 Malicious code in pass-rust-core (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in pass-rust-core (npm)

The package communicates with a domain associated with malicious activity...

candid-extractor (>=0.1.0, <=0.1.2), deterministic-wasi-ctx (0.1.14) +17 more potentially affected by CVE-2025-53901 via wasmtime (>=10.0.2, <=12.0.2)

wasmtime CARGO version =10.0.2, =0.1.0, =0.5.0, =0.5.0, =0.1.0, =0.1.0, =10.0.0, =10.0.0, =0.1.0, =0.1.2, =0.3.0, =10.0.0, =1.7.0, =1.8.0 and more Source cves: CVE-2025-53901 Source advisory: OSV:GHSA-FM79-3F68-H2FC...

candid-extractor (>=0.1.0, <=0.1.2), deterministic-wasi-ctx (0.1.14) +17 more potentially affected by CVE-2025-53901 via wasmtime (>=10.0.2, <=12.0.2)

wasmtime CARGO version =10.0.2, =0.1.0, =0.5.0, =0.5.0, =0.1.0, =0.1.0, =10.0.0, =10.0.0, =0.1.0, =0.1.2, =0.3.0, =10.0.0, =1.7.0, =1.8.0 and more Source cves: CVE-2025-53901 Source advisory: OSV:RUSTSEC-2025-0046...

[SECURITY] Fedora 41 Update: rust-sequoia-octopus-librnp-1.11.1-1.fc41

Reimplementation of RNP's interface using Sequoia for use with Thunderbird...

Fedora 42 : rust-sequoia-octopus-librnp (2025-51c16d6993)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-51c16d6993 advisory. Update to version 1.11.1. This version includes a fix for a potential DoS-via-zip-bomb issue. Release notes:...

Fedora 41 : rust-sequoia-octopus-librnp (2025-71b9c49854)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-71b9c49854 advisory. Update to version 1.11.1. This version includes a fix for a potential DoS-via-zip-bomb issue. Release notes:...