Ecosystem
crates.io
2,075 known vulnerabilities.
Most affected packages
2,074 results · Feed
-
Low —
Nervos CKB vulnerable to low-resource flood DDoS attacks through network message
### Workarounds * forbid request genesis through network request * forbid requesting duplicate data through network request
-
Low —
Nervos CKB calculation of program load cycles may be missed when executing in resume mode
### Impact The calculation of program load cycles may be missed when executing in resume mode. Since the script execution order is now determined, this issue does not cause network splitting.
-
Unscored —
Aliasing violation in `OrdSet` insertion
Inserting into an `im::OrdSet` (for example by collecting an iterator into one) can violate Rust's aliasing rules: Miri reports a stacked borrows violation in `sized_chunks::Chunk::force_copy()`, which is called during insertion, where a shared borrow is inva…
-
Low —
`tokio::io::ReadHalf<T>::unsplit` is Unsound
`tokio::io::ReadHalf<T>::unsplit` can violate the `Pin` contract The soundness issue is described in the [tokio/issues#5372](https://github.com/tokio-rs/tokio/issues/5372) Specific set of conditions needed to trigger an issue (a !Unpin type in ReadHalf) is un…
-
High —
Warp vulnerable to Path Traversal via Improper validation of Windows paths
Path resolution in `warp::filters::fs::dir` didn't correctly validate Windows paths meaning paths like `/foo/bar/c:/windows/web/screen/img101.png` would be allowed and respond with the contents of `c:/windows/web/screen/img101.png`. Thus users could potential…
-
Unscored —
buf_redux is Unmaintained
Last release was over three years ago. The maintainer(s) have been unreachable to respond to any issues that may or may not include security issues. The repository is now archived and there is no security policy in place to contact the maintainer(s) otherwise…
-
Unscored —
`kuchiki` is unmaintained
The `kuchiki` repo was marked as archived in [this](https://github.com/kuchiki-rs/kuchiki/commit/f92e4c047fdc30619555da282ac7ccce1d313aa6) commit. ## Possible Alternatives Possible alternatives may include: - [kuchikiki](https://crates.io/crates/kuchikiki) - …
-
Medium 5.3
libgit2 fails to verify SSH keys by default
libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the `certificate_che…
-
Medium —
ELF header parsing library doesn't check for valid offset
The crate has several unsafe sections that don't perform proper pointer validation. An example can be found in the following function: ``` fn section_header_raw(&self) -> &[ET::SectionHeader] { let sh_off = self.elf_header().section_header_offset() as usize; …
-
Medium —
bumpalo has use-after-free due to a lifetime error in `Vec::into_iter()`
In affected versions of this crate, the lifetime of the iterator produced by `Vec::into_iter()` is not constrained to the lifetime of the `Bump` that allocated the vector's memory. Using the iterator after the `Bump` is dropped causes use-after-free accesses.…
-
High 7.5
Interactive permission prompt spoofing in Deno
Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Multi-threaded programs were able to spoof interactive permission prompt by rewriting the prompt to suggest that program is waiting on user confirmation to unrelated action. A …
-
Critical 9.8CVE-2022-45299 Public exploit
webbrowser-rs allows attackers to access arbitrary files via supplying a crafted URL
An issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL.
-
Medium 5.3
Cargo did not verify SSH host keys
Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MITM) attacks. This vu…
-
High 7.5
bzip2 allows attackers to cause a denial of service via a large file that triggers an integer overflow
The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product.
-
Medium 5.4
Tokio's reject_remote_clients configuration may get dropped when creating a Windows named pipe
Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows named pipe server, setting `pipe_mode` will reset `reject_remote_clients` to `false`. If the applic…
-
Medium —
prettytable-rs: Force cast a &Vec<T> to &[T] may lead to undefined behavior
In function `Table::as_ref`, a reference of vector is force cast to slice. There are multiple problems here: 1. To guarantee the size is correct, we have to first do `Vec::shrink_to_fit`. The function requires a mutable reference, so we have to force cast fro…
-
Medium —
hyper-staticfile's location header incorporates user input, allowing open redirect
When `hyper-staticfile` performs a redirect for a directory request (e.g. a request for `/dir` that redirects to `/dir/`), the `Location` header value was derived from user input (the request path), simply appending a slash. The intent was to perform an origi…
-
Medium 6.8
Tauri vulnerable to path traversal
Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Sc…
-
Unscored —
crate has been renamed to `embedded-alloc`
This crate has been renamed from `alloc-cortex-m` to `embedded-alloc`. The new repository location is: <https://github.com/rust-embedded/embedded-alloc>
-
Medium 5.4
Light client verification not taking into account chain ID
Tendermint is a high-performance blockchain consensus engine for Byzantine fault tolerant applications. Versions prior to 0.28.0 contain a potential attack via Improper Verification of Cryptographic Signature, affecting anyone using the tendermint-light-clien…
-
High 7.5
X.509 Policy Constraints Double Locking
If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process …
-
Medium 4.0
rust-vmm linux-loader vulnerable to Out-of-bounds Read
In versions prior to 0.8.1, the linux-loader crate uses the offsets and sizes provided in the ELF headers to determine the offsets to read from. If those offsets point beyond the end of the file this could lead to Virtual Machine Monitors using the `linux-loa…
-
Medium —
Candy Machine Set Collection During Mint Missing Check
A problem with Candy Machine V2 allow minting NFTs to an arbitrary collection due to a missing check. Here is a description of the exploit: Details: Here is the tx/ix to exploit: Transaction: Ix 1: candy_machine v2, mint_nft, passing in empty metadata -1 Ix 2…
-
High —
Creator Verification Error when Bubblegum Activate
This was an error found by @metamania01 of the Audit Company Solshield. It allowed one to verify a creator that did not sign by making use of a provision in Token Metadata that allows Creators who have signed compressed nfts to allow them to decompress with v…
-
Medium —
Unsound API in `secp256k1` allows use-after-free and invalid deallocation from safe code
Because of incorrect bounds on method `Secp256k1::preallocated_gen_new` it was possible to cause use-after-free from safe consumer code. It was also possible to "free" memory not allocated by the appropriate allocator. The method takes a place for storing the…
-
High 7.5
libp2p-rust denial of service vulnerability from lack of resource management
libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.45.1 an attacker node can cause a victim node to allocate a large number of small memory chunks, which can ultimately lead to the victim’s process …
-
Medium —
hyper-staticfile's improper validation of Windows paths could lead to directory traversal attack
Path resolution in `hyper-staticfile` didn't correctly validate Windows paths, meaning paths like `/foo/bar/c:/windows/web/screen/img101.png` would be allowed and respond with the contents of `c:/windows/web/screen/img101.png`. Thus users could potentially re…
-
Unscored —
`claim` is Unmaintained
The last release was in February 2021, almost two years ago. The maintainer has been unresponsive regarding this crate for over a year. A pending issue with `claim`'s dependencies has made the crate [difficult to use](https://github.com/svartalf/rust-claim/is…
-
Unscored —
parity-util-mem Unmaintained
The crate has been deprecated and will receive no updates with no repository source. The crate has [a warning](https://crates.io/crates/parity-util-mem) surrounding it's use related to global allocator use that may lead to UB.
-
Medium 5.4
Cap'n Proto vulnerable to out-of-bounds read due to logic error handling list-of-list.
Cap'n Proto is a data interchange format and remote procedure call (RPC) system. Cap'n Proro prior to versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3, as well as versions of Cap'n Proto's Rust implementation prior to 0.13.7, 0.14.11, and 0.15.2 are vulnerable to out…
-
Medium 5.6
Exposure of sensitive information in aliyun-oss-client
aliyun-oss-client is a rust client for Alibaba Cloud OSS. Users of this library will be affected, the incoming secret will be disclosed unintentionally. This issue has been patched in version 0.8.1.
-
Medium 5.9
Wasmtime vulnerable to out of bounds read/write with zero-memory-pages configuration
Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator when the allocator is configured to give WebAssembly instances a maximum of zero pages of memory. In this c…
-
High 8.6
Wasmtime vulnerable to data leakage between instances in the pooling allocator
Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior…
-
Low 3.8
wasmtime_trap_code C API function has out of bounds write vulnerability
Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` header file. This discr…
-
Low 2.6
Tauri Filesystem Scope can be Partially Bypassed
Tauri is a framework for building binaries for all major desktop platforms. In versions prior to 1.0.7 and 1.1.2, Tauri is vulnerable to an Incorrectly-Resolved Name. Due to incorrect escaping of special characters in paths selected via the file dialog and dr…
-
Medium —
Invalid use of `mem::uninitialized` causes `use-of-uninitialized-value`
The compression and decompression function used `mem:uninitialized` to create an array of uninitialized values, to later write values into it. This later leads to reads from uninitialized memory. The flaw was corrected in commit b633bf265e41c60dfce3be7eac4e4d…
-
High —
ckb type_id script resume may randomly fail
### Impact https://github.com/nervosnetwork/ckb/blob/v0.101.2/script/src/verify.rs#L871-L879 TypeIdSystemScript resume handle is not correct when max_cycles is not enough, `ScriptError::ExceededMaximumCycles` will be raised directly ranther than suspend as ex…
-
Critical —
ckb: Transaction header_deps validation issue (network forking)
### Impact fn `HeaderChecker#check_valid` skipped main chain checking after this PR: https://github.com/nervosnetwork/ckb/pull/1646/files#diff-c4e017b67c1b3005ca0c446a9b0879571aa36a858b1f7ddd1b9328a884e3214bR171-R176 It will cause network forking if one trans…
-
Medium —
ckb: Large dep group requires a lot of resources to process but the cost to commit the transaction is very low.
### Impact When a transaction contains a dep group with many cells, the resources required to process it are not linear to the transaction size nor spent script cycles. ### Patches In 0.43.3, nodes drop the transactions relayed to them when they contain a dep…
-
High 7.5
X.509 Email Address 4-byte Buffer Overflow
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the ap…