The vulnerability of the HTTP library for Rust Hyper, related to unlimited resource distribution, allows attackers to cause service failures.

The vulnerability of the HTTP library for Rust Hyper relates to the unlimited distribution of resources. Exploiting this vulnerability could allow a remote attacker to cause service failures...

fp-evm (1.0.0), fp-rpc (1.0.0) +10 more potentially affected by CVE-2021-29511 via evm (0.25.0)

evm CARGO version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on evm and may be impacted: - fp-evm 1.0.0 - fp-rpc 1.0.0 - fp-storage 1.0.0 - pallet-ethereum 1.0.0 - pallet-evm 3.0.0 - pallet-evm-precompile-blake2 1.0.0 -...

Memory over-allocation in evm crate

Impact Prior to the patch, when executing specific EVM opcodes related to memory operations that use evmcore::Memory::copylarge, the crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. Patches The flaw was corrected in comm...

evm (>=0.13.0, <=0.20.0), evm-gasometer (>=0.13.0, <=0.20.0) +2 more potentially affected by CVE-2021-29511 via evm-core (>=0.13.1, <=0.20.0)

evm-core CARGO version =0.13.1, =0.13.0, =0.13.0, =0.13.0, =2.0.0-alpha.3, =2.0.1 Source cves: CVE-2021-29511 Source advisory: OSV:GHSA-4JWQ-572W-4388...

Albabat, Kasseika, Kuiper: New Ransomware Gangs Rise with Rust and Golang

Cybersecurity researchers have detected in the wild yet another variant of the Phobos ransomware family known as Faust. Fortinet FortiGuard Labs, which detailed the latest iteration of the ransomware, said it's being propagated by means of an infection that delivers a Microsoft Excel document .XL...

chimper (>=0.3.0, <=0.4.0), conrod_example_shared (>=0.62.0, <=0.76.1) +26 more potentially affected by unknown CVE via conrod_core (>=0.62.0, <=0.76.1)

conrodcore CARGO version =0.62.0, =0.3.0, =0.62.0, =0.0.1, =0.67.0, =0.62.0, =0.71.0, =0.1.0, =0.1.0, =0.62.0, =0.69.0, =0.62.0, =0.2.1, =0.1.0, =0.24.0, =0.1.0-docfix, =0.25.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0396...

carpo (>=0.1.2, <=0.1.3) potentially affected by unknown CVE via conrod (0.61.1)

conrod CARGO version 0.61.1 is affected by a known vulnerability. The following packages have a transitive dependency on conrod and may be impacted: - carpo =0.1.2, =0.1.3 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0397...

bump (0.0.0), resufancy (>=0.1.0, <=0.1.1) potentially affected by unknown CVE via filesystem (0.4.4)

filesystem CARGO version 0.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on filesystem and may be impacted: - bump 0.0.0 - resufancy =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0015...

oniguruma: Use-after-free in onig_new_deluxe() in regext.c

A use-after-free in onignewdeluxe in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte...

blake-streams (0.1.0), canary (>=0.0.6, <=0.1.6) +65 more potentially affected by CVE-2024-58265 via snow (>=0.1.9, <=0.9.3)

snow CARGO version =0.1.9, =0.0.6, =0.8.0, =0.1.0, =0.1.0, =0.1.5, =0.8.0, =0.10.0, =1.0.0-rc.2, =0.8.0, =0.8.0, =1.0.0-rc.1, =0.13.0-rc.1, =1.0.0-rc.1, =0.8.0, =1.0.0 and more Source cves: CVE-2024-58265 Source advisory: OSV:GHSA-7G9J-G5JG-3VV3...

objstor (>=0.4.6, <=0.4.20), rblog (>=0.100.0, <=0.123.0) +18 more potentially affected by CVE-2024-23644 via trillium-http (>=0.2.14, <=0.3.3)

trillium-http CARGO version =0.2.14, =0.4.6, =0.100.0, =0.2.0, =0.2.0-rc.1, =0.1.0, =0.2.0, =0.0.1, =0.2.0, =0.2.0, =0.3.0, =0.3.1 and more Source cves: CVE-2024-23644 Source advisory: OSV:GHSA-9F9P-CP3C-72JF...

objstor (>=0.4.6, <=0.4.20), trillium-acme (>=0.1.0, <=0.1.1) +2 more potentially affected by CVE-2024-23644 via trillium-client (>=0.2.2, <=0.4.9)

trillium-client CARGO version =0.2.2, =0.4.6, =0.1.0, =0.2.0, =0.5.0 Source cves: CVE-2024-23644 Source advisory: OSV:GHSA-9F9P-CP3C-72JF...

CVE-2024-23644

Trillium is a composable toolkit for building internet applications with async rust. In trillium-http prior to 0.3.12 and trillium-client prior to 0.5.4, insufficient validation of outbound header values may lead to request splitting or response splitting attacks in scenarios where attackers have...

CVE-2024-23644 trillium-http and trillium-client vulnerable to HTTP Request/Response Splitting

Trillium is a composable toolkit for building internet applications with async rust. In trillium-http prior to 0.3.12 and trillium-client prior to 0.5.4, insufficient validation of outbound header values may lead to request splitting or response splitting attacks in scenarios where attackers have...

CVE-2024-23644

CVE-2024-23644 affects Trillium, specifically the crates trillium-http (versions prior to 0.3.12) and trillium-client (prior to 0.5.4). The issue is improper validation of outbound header values and names, where header values/names can be constructed infallibly and may contain illegal bytes. If a...

anchor-token (>=0.0.1, <=0.3.0), archid-marketplace (>=1.0.5, <=1.0.8) +150 more potentially affected by CVE-2024-58264 via serde-json-wasm (>=0.1.3, <=0.4.1)

serde-json-wasm CARGO version =0.1.3, =0.0.1, =1.0.5, =1.0.0, =1.0.0, =0.3.1, =0.1.0, =2.5.2, =0.1.0, =1.0.0, =0.4.0, =1.0.0, =2.2.0 - cosmwasm-contract-migratable-std 0.1.0 and more Source cves: CVE-2024-58264 Source advisory: OSV:RUSTSEC-2024-0012...

RHCOS 4 : OpenShift Container Platform 4.12.9 (RHSA-2023:1408)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:1408 advisory. - capnproto: out of bounds read when handling a list of lists. CVE-2022-46149 Note that Nessus has not tested for this issue but has instead...

blake-streams (0.1.0), canary (>=0.0.6, <=0.1.6) +65 more potentially affected by CVE-2024-58265 via snow (>=0.1.9, <=0.9.3)

snow CARGO version =0.1.9, =0.0.6, =0.8.0, =0.1.0, =0.1.0, =0.1.5, =0.8.0, =0.10.0, =1.0.0-rc.2, =0.8.0, =0.8.0, =1.0.0-rc.1, =0.13.0-rc.1, =1.0.0-rc.1, =0.8.0, =1.0.0 and more Source cves: CVE-2024-58265 Source advisory: OSV:RUSTSEC-2024-0011...

objstor (>=0.4.6, <=0.4.20), trillium-acme (>=0.1.0, <=0.1.1) +2 more potentially affected by CVE-2024-23644 via trillium-client (>=0.2.2, <=0.4.9)

trillium-client CARGO version =0.2.2, =0.4.6, =0.1.0, =0.2.0, =0.5.0 Source cves: CVE-2024-23644 Source advisory: OSV:RUSTSEC-2024-0008...

objstor (>=0.4.6, <=0.4.20), rblog (>=0.100.0, <=0.123.0) +18 more potentially affected by CVE-2024-23644 via trillium-http (>=0.2.14, <=0.3.3)

trillium-http CARGO version =0.2.14, =0.4.6, =0.100.0, =0.2.0, =0.2.0-rc.1, =0.1.0, =0.2.0, =0.0.1, =0.2.0, =0.2.0, =0.3.0, =0.3.1 and more Source cves: CVE-2024-23644 Source advisory: OSV:RUSTSEC-2024-0009...