Ecosystem
crates.io
2,075 known vulnerabilities.
Most affected packages
2,074 results · Feed
-
High 7.5
Use after free in lru crate
An issue was discovered in the lru crate before 0.7.1 for Rust. The iterators have a use-after-free, as demonstrated by an access after a pop operation.
-
Critical 9.8
Use of Uninitialized Resource in csv-sniffer.
An issue was discovered in the csv-sniffer crate through 2021-01-05 for Rust. preamble_skipcount may read from uninitialized memory locations.
-
High 7.5
Use of Uninitialized Resource in smallvec
An issue was discovered in the smallvec crate before 0.6.13 for Rust. It can create an uninitialized value of any type, including a reference type.
-
Unscored —
cargo-download is unmaintained
The cargo download subcommand (via cargo-download crate) is broken and maintainer has disappeared from GitHub and hasn't had any commits for a year. Using this downloader will result to corrupted crates. Maintainer has not responded to maintenance takeover. J…
-
Unscored —
dotenv is Unmaintained
dotenv by description is meant to be used in development or testing only. Using this in production may or may not be advisable. ## Alternatives The below may or may not be feasible alternative(s): - [dotenvy_codegen_impl](https://crates.io/crates/dotenvy_code…
-
Unscored —
dotenv is Unmaintained
dotenv by description is meant to be used in development or testing only. Using this in production may or may not be advisable. ## Alternatives The below may or may not be feasible alternative(s): - [dotenvy](https://crates.io/crates/dotenvy)
-
High —
DoS Vulnerability from Upstream Actix Web Issues
### Impact This vulnerability affects all users of the `perseus deploy` functionality who have not exported their sites to static files. If you are using the inbuilt Perseus server in production, there is a memory leak in Actix Web stemming from [this upstrea…
-
High 7.5
Invalid handling of X509_verify_cert() internal errors in libssl
Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (for example out of memory). Such a negative return value is …
-
Unscored —
`encoding` is unmaintained
Last release was on 2016-08-28. The [issue](https://github.com/lifthrasiir/rust-encoding/issues/127) inquiring as to the status of the crate has gone unanswered by the maintainer. ## Possible alternatives - [encoding_rs](https://crates.io/crates/encoding_rs)
-
High 8.5
Use After Free in lucet
Lucet is a native WebAssembly compiler and runtime. There is a bug in the main branch of `lucet-runtime` affecting all versions published to crates.io that allows a use-after-free in an Instance object that could result in memory corruption, data race, or oth…
-
High 7.5
Improper Input Validation in fruity
An issue was discovered in the fruity crate through 0.2.0 for Rust. Security-relevant validation of filename extensions is plausibly affected. Methods of NSString for conversion to a string may return a partial result. Because they call CStr::from_ptr on a po…
-
High 7.5
gzip transfer encoding caused out-of-memory crash
NLnet Labs Routinator versions 0.9.0 up to and including 0.10.1, support the gzip transfer encoding when querying RRDP repositories. This encoding can be used by an RRDP repository to cause an out-of-memory crash in these versions of Routinator. RRDP uses XML…
-
High 7.5
Infinite length chain of RRDP repositories
NLnet Labs Routinator prior to 0.10.2 happily processes a chain of RRDP repositories of infinite length causing it to never finish a validation run. In RPKI, a CA can choose the RRDP repository it wishes to publish its data in. By continuously generating a ne…
-
Medium —
Unexpected panics in num-bigint
### Impact Two scenarios were reported where `BigInt` and `BigUint` multiplication may unexpectedly panic. - The internal `mac3` function did not expect the possibility of non-empty all-zero inputs, leading to an `unwrap()` panic. - A buffer was allocated wit…
-
Unscored —
sodiumoxide is deprecated
Alternatives may be found - not in any specific order: - [libsodium-sys-stable](https://crates.io/crates/libsodium-sys-stable) - [dryoc](https://crates.io/crates/dryoc) - [RustCrypto/nacl-compat](https://github.com/RustCrypto/nacl-compat) (`crypto_box`, `cryp…
-
High 8.2
Improper sanitization of delegated role names in tough
Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not properly sanitize delegated role names when caching a repository, or when loading a repository from…
-
High 8.2
Improper sanitization of target names in tough
Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not properly sanitize target names when caching a repository, or when saving specific targets to an out…
-
High 8.7
Specification non-compliance in JUMPI
The evm crate is a pure Rust implementation of Ethereum Virtual Machine. In `evm` crate `< 0.31.0`, `JUMPI` opcode's condition is checked after the destination validity check. However, according to Geth and OpenEthereum, the condition check should happen befo…
-
Medium 5.3
Validity check for signed Frontier-specific extrinsic not called in block execution
Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for `pallet-ethereum`, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Ma…
-
Unscored —
XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags
The neutralization that ammonia applied to `animate` and `set` was not applied to other forms of SVG animation, which can be used for XSS. The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it. ```xml <…
-
Unscored —
Incorrect escaping for `url("")` functions in CSS style attributes
In some cases, quotation marks in CSS url() functions are not escaped. This allows CSS injection. This feature is not enabled by default, so an application is vulnerable if, and only if, the style attribute is allowed and filter_style_properties is used. As a…
-
Medium 6.3
Use after free passing `externref`s to Wasm in Wasmtime
Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.19.0 and before version 0.30.0 there was a use-after-free bug when passing `externref`s from the host to guest Wasm content. To trigger the bug, you have to explicitly pass …
-
Medium 6.5
Memory Safety Issue when using patch or merge on state and assign the result back to state
Tremor is an event processing system for unstructured data. A vulnerability exists between versions 0.7.2 and 0.11.6. This vulnerability is a memory safety Issue when using `patch` or `merge` on `state` and assign the result back to `state`. In this case, aff…
-
Medium 5.3
Transaction validity oversight in pallet-ethereum
Frontier is Substrate's Ethereum compatibility layer. Prior to commit number 0b962f218f0cdd796dadfe26c3f09e68f7861b26, a bug in `pallet-ethereum` can cause invalid transactions to be included in the Ethereum block state in `pallet-ethereum` due to not validat…
-
Medium —
Uncontrolled recursion leads to abort in deserialization
Affected versions of this crate did not properly check for recursion while deserializing aliases. This allows an attacker to make a YAML file with an alias referring to itself causing an abort. The flaw was corrected by checking the recursion depth.
-
Medium —
Unchecked vector pre-allocation
Affected versions of this crate pre-allocate memory on deserializing raw buffers without checking whether there is sufficient data available. This allows an attacker to do denial-of-service attacks by sending small msgpack messages that allocate gigabytes of …
-
Medium —
Memory over-allocation in evm-core
Prior to the patch, when executing specific EVM opcodes related to memory operations that use `evm_core::Memory::copy_large`, the crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. The…
-
High —
fake-static allows converting any reference into a `'static` reference
fake-static allows converting a reference with any lifetime into a reference with `'static` lifetime without the `unsafe` keyword. Internally, this crate does not use unsafe code, it instead exploits a soundness bug in rustc
-
Unscored —
Crate has been renamed to `cosmrs`
The `cosmos_sdk` crate, which provides a basic Rust SDK for the Cosmos ecosystem, has rebranded to “CosmRS” in the spirit of other projects like CosmJS and CosmWasm. You can find the new home here: https://github.com/cosmos/cosmos-rust/tree/main/cosmrs The ne…
-
High 7.4
Read buffer overruns processing ASN.1 strings
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string dat…
-
Critical 9.8
SM2 Decryption Buffer Overflow
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" paramet…
-
Unscored —
ansi_term is Unmaintained
The maintainer has advised that this crate is deprecated and will not receive any maintenance. The crate does not seem to have much dependencies and may or may not be ok to use as-is. Last release seems to have been three years ago. ## Possible Alternative(s)…
-
Unscored —
spirv_headers is unmaintained, use spirv instead
Because of versioning issues; the `spirv_headers` crate is unmaintained. Use [spirv](https://crates.io/crates/spirv) for parsing spirv files.
-
Unscored —
serde_cbor is unmaintained
The `serde_cbor` crate is unmaintained. The author has archived the github repository. Alternatives proposed by the author: * [`ciborium`](https://crates.io/crates/ciborium) * [`minicbor`](https://crates.io/crates/minicbor)
-
High 7.5
Links in archive can create arbitrary directories
An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal.
-
High 7.5
HTTP Request Smuggling in actix-http
An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust. HTTP/1 request smuggling (aka HRS) can occur, potentially leading to credential disclosure.
-
Critical 9.8
Use of Uninitialized Resource in alg_ds
An issue was discovered in the alg_ds crate through 2020-08-25 for Rust. There is a drop of uninitialized memory in Matrix::new().
-
High 7.5
Unaligned memory allocation in chunky
An issue was discovered in the chunky crate through 2020-08-25 for Rust. The Chunk API does not honor an alignment requirement.
-
Critical 9.8
Double free in sys-info
An issue was discovered in the sys-info crate before 0.8.0 for Rust. sys_info::disk_info calls can trigger a double free.
-
High 8.1
Data race in ruspiro-singleton
An issue was discovered in the ruspiro-singleton crate before 0.4.1 for Rust. In Singleton, Send and Sync do not have bounds checks.