Some Ref methods are unsound with some type parameters

The Ref methods intoref, intomut, intoslice, and intoslicemut are unsound and may allow safe code to exhibit undefined behavior when used with Ref where B is cell::Ref or cell::RefMut. Note that these methods remain sound when used with B types other than cell::Ref or cell::RefMut. See...

`martin-mbtiles` has been renamed to `mbtiles`

Please use the mbtiles crate going forward...

Potential stack use-after-free in `Instrumented::into_inner`

The implementation of the Instrumented::intoinner method in affected versions of this crate contains undefined behavior due to incorrect use of std::mem::forget The function creates const pointers to self, calls mem::forgetselfstd::mem::forget, and then moves values out of those pointers using...

`hpack` is unmaintained

The hpack crate is no longer maintained. Consider using fluke-hpack or httlib-huffman...

BER/CER/DER decoder panics on invalid input

Due to insufficient checking of input data, decoding certain data sequences can lead to bcder panicking rather than returning an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding. bcder 0.7.3 fixes these issues by more...

Default functions in VolatileMemory trait lack bounds checks, potentially leading to out-of-bounds memory accesses

An issue was discovered in the default implementations of the VolatileMemory::getatomicref, alignedasref, alignedasmut, getref, getarrayref trait functions, which allows out-of-bounds memory access if the VolatileMemory::getslice function returns a VolatileSlice whose length is less than the...

rustls-webpki: CPU denial of service in certificate path building

When this crate is given a pathological certificate chain to validate, it will spend CPU time exponential with the number of candidate certificates at each step of path building. Both TLS clients and TLS servers that accept client certificate are affected. We now give each path building operation...

ftp is unmaintained, use suppaftp instead

The ftp crate is not maintained any more; use suppaftp instead...

Use After Free with `externref`s in Wasmtime

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5fhj-g3p3-pq9g. For more information see the GitHub-hosted security advisory...

`decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)

The tar-family extractors in decompress .tar, .tar.gz, .tar.xz, .tar.bz2, .tar.zst build each output path from the raw archive entry path and write to it with no traversal check, so a malicious archive can write files outside the destination directory, a "tar-slip" / zip-slip path traversal CWE-2...

Auto-Reseeding HMAC-DRBG could panic for some output lengths

The automatically reseeding implementations of HMAC-DRBG would panic if called with a desired non-zero output length cleanly divisible by 65536, the maximum number of output bytes that can be generated before reseeding has to happen. Impact An application relying on libcrux-hmac-drgb to provide...

`rsa-export` is unmaintained

This crate has been deprecated in favour of using the native support for exporting RSA keys into the standard PEM format. See docs.rs documentation. In addition to that, the operations in this crate arithmetic and Base64 encoding are not done in constant-time, potentially exposing the user to...

Puccinier is unmainted.

The tool has been deprecated in favor of Catppuccin's new tool, whiskers crates.io...

Non-idiomatic use of iterators leads to use after free

Code that attempts to use an item e.g., a row returned by an iterator after the iterator has advanced to the next item will be accessing freed memory and experience undefined behaviour. Code that uses the item and then advances the iterator is unaffected. This problem has always existed. This is ...

`conrod_core` is unmaintained

The conrodcore crate is no longer maintained. The author suggests egui as a potential alternative...

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

Summary Insufficient validation of outbound header values may lead to request splitting or response splitting attacks in scenarios where attackers have sufficient control over outbound headers. Details Outbound trilliumhttp::HeaderValue and trilliumhttp::HeaderName can be constructed infallibly a...

Remotely exploitable DoS condition in Rosenpass <=0.2.0

Affected version do this crate did not validate the size of buffers when attempting to decode messages. This allows an attacker to trigger a panic by sending a UDP datagram with a 1 byte payload over network. This flaw was corrected by validating the size of the buffers before attempting to decod...

Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86\_64

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gw5p-q8mj-p7gh. For more information see the GitHub-hosted security advisory...

Miscompilation of `i8x16.select` with the same inputs on x86\_64

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xm67-587q-r2vw. For more information see the GitHub-hosted security advisory...

Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm For more information see the GitHub-hosted security advisory...

`zvariant` is unmaintained

The zvariant crate is no longer maintained as a standalone crate. It has been merged into zbus starting with version 6.0.0, as its wire module. Users should migrate to zbus, with its default features disabled if they only need the D-Bus wire format. Users of the GVariant format should migrate to...

Yielding in a component start function can lead to a host panic

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g For more information see the GitHub-hosted security advisory...

Host panic when component `call_async` is cancelled under some conditions

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory...

Unauthenticated ServerHello can downgrade later connections to classical key exchange

The client recorded the server-selected key exchange group for each server name when processing the ServerHello, before the server was authenticated. This record is used to predict which key share to send in future ClientHellos to that server name. A network attacker can answer one connection...

Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM)

A crafted .zst input under 128 KB can force ruzstd to allocate several gigabytes at once, crashing the process with an out-of-memory condition. Since ruzstd is a decoder for untrusted input, a single small file is enough to take down anything decoding it. The compressed size of a block was capped...

`unzip`: archive extraction is vulnerable to path traversal (zip-slip)

Summary Unzipper::unzip extracts each archive entry to a path built from the entry's raw, attacker-controlled name without any traversal check. A ZIP archive whose entry names contain ../ components or an absolute path can therefore cause files to be written outside the destination directory chos...

Low severity (DoS) vulnerability in sequoia-openpgp

There is a denial-of-service vulnerability in sequoia-openpgp, our crate providing a low-level interface to our OpenPGP implementation. When triggered, the process will enter an infinite loop. Many thanks to Andrew Gallagher for disclosing the issue to us. Impact Any software directly or indirect...

`generational-arena` is unmaintained

The generational-arena crate's repository has been archived and is no longer maintained. Alternatives - slotmap...

filesystem-rs may be implicitly unmaintained

The last release was over 5 years ago, and the last commit was over 4 years ago. The maintainers have not responded to a pull request to update dependencies that are themselves unmaintained, and which poses the question of maintenance...

`cosmwasm` is unmaintained

The crate cosmwasm is not used anymore since spring 2020. The functionality was split in multiple different crates, such as the standard library cosmwasm-std and the virtual machine cosmwasm-vm. An overview can be found in the cosmwasm repository. If you have this crate in your dependency tree,...

`dlopen_derive` is unmaintained

dlopenderive hasn't been updated since June 9, 2019. dlopenderive depends on quote = "0.6.12" and syn = "0.15.34". Versions 1.0.0 of these dependencies were published on August 13, 2019. The 0. versions haven't received updates since. Note that dlopen is an unmaintained crate from the same...

Miscompilation of constant values in division on AArch64

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7f6x-jwh5-m9r4. For more information see the GitHub-hosted security advisory...

Use after free with `externref`s and epoch interruption in Wasmtime

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gwc9-348x-qwv2. For more information see the GitHub-hosted security advisory...

`wasi-http` p3: forwarded trailers aren't checked against `is_forbidden_header` hook

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxcf-8qw5-5c33 For more information see the GitHub-hosted security advisory...

`zbus_names` is unmaintained

The zbusnames crate is no longer maintained as a standalone crate. It has been merged into zbus starting with version 6.0.0, as its names module. Users should migrate to zbus, with its default features disabled if they only need the D-Bus name types...

Panic when pending calls are run after a trap

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5 For more information see the GitHub-hosted security advisory...

Guests can send absolute-form HTTP requests to different hosts

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx For more information see the GitHub-hosted security advisory...

Out-of-bounds zero-length stream writes can panic

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc For more information see the GitHub-hosted security advisory...

Stack overflow dropping a long chain of recursive types

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory...

ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target

ZipStreamReader::extract applies Unix permissions through extracted symlinks without validating the symlink target stays within the destination For further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-4684-h2q9-2vcp...

Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation

The zip crate preserves privileged Unix permission bits SUID, SGID, and sticky bits from ZIP externalattributes during extraction, instead of masking them to safe permission bits. If a privileged process for example, root in an installer, CI/CD pipeline, or container build extracts an...

zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory

In zip 9.0.0-pre2, ZipArchive::extract creates a symbolic link from an archive entry after validating only the output entry path. The link target bytes are passed directly to the platform symlink API, so a malicious archive can create an entry inside the destination that resolves to an...

Poly1305 panics or computes a wrong tag on attacker-chosen messages of 64 bytes or more

Poly1305 in ic-cipher absorbs messages of 64 bytes or more four blocks at a time, summing four products before one reduction. From 0.2.5 to 0.2.19 the reduction kept its carries in 32-bit integers, which four summed products can overflow when the message's bytes are large. This affects Poly1305 a...

`unzip` is unmaintained

The unzip crate has only ever released a single version, 0.1.0 published 2017-12-23, and has seen no further activity. It appears to be unmaintained, and its known path-traversal "zip-slip" vulnerability will not be fixed. Consider migrating to an actively maintained alternative such as zip...

Wasmtime doesn't fully sandbox all the Windows device filenames

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-c2f5-jxjv-2hh8. For more information see the GitHub-hosted security advisory...

`wasi-http` p3: Guests can set incorrect content-length for spliced response bodies

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9prg-84vf-g5fc For more information see the GitHub-hosted security advisory...

`wasi-http`: Guests can add conflicting content lengths to messages

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-r8xh-cgf7-392j For more information see the GitHub-hosted security advisory...

Bundled root certificates allow trust in distrusted emSign intermediates

Affected versions include emSign ECC Root CA - G3, which can allow certificate paths through distrusted emSign intermediates. Affected versions may accept certificate paths containing distrusted emSign intermediate public keys. The private keys corresponding to these intermediates are now well...

Missing case-insensitive matching for CSS url function

URL filtering, such as relative URLs and URL scheme limits, is not always applied when CSS sanitization is used. When the inner URL is quoted, CSS url"" is matched case-sensitively, when it should be matched case-insensitively. As a result, while url"" gets the intended domain name filtering, URL...

`zvariant_derive` is unmaintained

The zvariantderive crate is no longer maintained as a standalone crate. Its derive macros are provided by zbus starting with version 6.0.0. Users should migrate to zbus, with its default features disabled if they only need the D-Bus wire format...