AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure

Summary In the AES GCM implementation of decryptinplacedetached, the decrypted ciphertext i.e. the correct plaintext is exposed even if tag verification fails. Impact If a program using the aes-gcm crate's decryptinplace APIs accesses the buffer after decryption failure, it will contain a...

CVE-2023-42811

aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decryptinplacedetached, the decrypted ciphertext i.e. the correct plaintext is exposed even if tag verification fails. If a program using the aes-gcm...

CVE-2023-42811 AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure

aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decryptinplacedetached, the decrypted ciphertext i.e. the correct plaintext is exposed even if tag verification fails. If a program using the aes-gcm...

CVE-2023-42811

The CVE-2023-42811 issue affects the aes-gcm Rust crate (AES-GCM implementation). In versions before 0.10.3, decrypt_in_place_detached could expose the decrypted plaintext in the buffer after a tag verification failure, potentially enabling CCAs and full plaintext recovery depending on the progra...

CVE-2023-42811 AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure

aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decryptinplacedetached, the decrypted ciphertext i.e. the correct plaintext is exposed even if tag verification fails. If a program using the aes-gcm...

SUSE CVE-2023-43669

The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service minutes of CPU consumption via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted e.g., thousands of times and the average amount...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : rust, rust1.72 (SUSE-SU-2023:3722-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3722-1 advisory. Changes in rust: - Update to version 1.72.0 - for details see the rust1.72 package Changes in rust1.72: -...

actix-remote (0.1.0), anchor-client (0.26.0) +181 more potentially affected by CVE-2023-42805 via quinn-proto (>=0.2.0, <=0.8.4)

quinn-proto CARGO version =0.2.0, =0.2.3, =0.4.0, =0.1.0, =0.2.5, =0.6.0, =0.0.1, =0.1.0, =0.0.1, =0.1.9, =0.0.2, =0.0.103 and more Source cves: CVE-2023-42805 Source advisory: OSV:GHSA-Q8WC-J5M9-27W3...

phonenumber panics on parsing crafted RFC3966 inputs

Impact The phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string .;phone-context=. Patches...

validator (>=0.6.1, <=0.6.3) potentially affected by CVE-2023-42444 via phonenumber (0.1.0+8.7.0)

phonenumber CARGO version 0.1.0+8.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on phonenumber and may be impacted: - validator =0.6.1, =0.6.3 Source cves: CVE-2023-42444 Source advisory: OSV:GHSA-WHHR-7F2W-QQJ2...

actix-remote (0.1.0), anchor-client (0.26.0) +181 more potentially affected by CVE-2023-42805 via quinn-proto (>=0.2.0, <=0.8.4)

quinn-proto CARGO version =0.2.0, =0.2.3, =0.4.0, =0.1.0, =0.2.5, =0.6.0, =0.0.1, =0.1.0, =0.0.1, =0.1.9, =0.0.2, =0.0.103 and more Source cves: CVE-2023-42805 Source advisory: OSV:RUSTSEC-2023-0063...

SUSE-SU-2023:3722-1 Security update for rust, rust1.72

This update for rust, rust1.72 fixes the following issues: Changes in rust: - Update to version 1.72.0 - for details see the rust1.72 package Changes in rust1.72: - CVE-2023-40030: fix minor non-exploited issue in cargo bsc1214689 Version 1.72.0 2023-08-24 ========================== Language...

GHSA-9MCR-873M-XCXP Tungstenite allows remote attackers to cause a denial of service

The Tungstenite crate through 0.20.0 for Rust allows remote attackers to cause a denial of service minutes of CPU consumption via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted e.g., thousands of times and the average amoun...

Tungstenite allows remote attackers to cause a denial of service

The Tungstenite crate through 0.20.0 for Rust allows remote attackers to cause a denial of service minutes of CPU consumption via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted e.g., thousands of times and the average amoun...

ac-rumqttc (>=0.21.0-alpha.1, <=0.21.0-alpha.2), acme (0.1.40) +1106 more potentially affected by CVE-2023-43669 via tungstenite (>=0.5.4, <=0.19.0)

tungstenite CARGO version =0.5.4, =0.21.0-alpha.1, =0.1.41, =0.1.0, =0.0.4, =0.1.0, =0.10.0-alpha.1.6, =0.6.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0 and more Source cves: CVE-2023-43669 Source advisory: OSV:GHSA-9MCR-873M-XCXP...

DEBIAN-CVE-2023-43669

The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service minutes of CPU consumption via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted e.g., thousands of times and the average amount...

CVE-2023-43669

The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service minutes of CPU consumption via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted e.g., thousands of times and the average amount...

CVE-2023-43669

The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service minutes of CPU consumption via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted e.g., thousands of times and the average amount...

CVE-2023-43669

The CVE-2023-43669 issue affects the Tungstenite crate for Rust up to version 0.20.0, where an excessively long HTTP header in a client handshake can cause high CPU usage and denial of service. Affected projects using tungstenite (and dependent crates like tokio-tungstenite) are exposed to potent...

CVE-2023-43669

The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service minutes of CPU consumption via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted e.g., thousands of times and the average amount...