# Recent vulnerabilities from OSV Rustsec 🦀

## [rustsec-2016-0002](https://vulnerability.circl.lu/vuln/rustsec-2016-0002)

```json
{
  "id": "RUSTSEC-2016-0002",
  "modified": "2023-06-13T13:10:24Z",
  "published": "2016-05-09T12:00:00Z",
  "aliases": [
    "CVE-2016-10932",
    "GHSA-9xjr-m6f3-v5wm"
  ],
  "related": [
    "RUSTSEC-2016-0001"
  ],
  "summary": "HTTPS MitM vulnerability due to lack of hostname verification",
  "details": "When used on Windows platforms, all versions of Hyper prior to 0.9.4 did not\nperform hostname verification when making HTTPS requests.\n\nThis allows an attacker to perform MitM attacks by preventing any valid\nCA-issued certificate, even if there's a hostname mismatch.\n\nThe problem was addressed by leveraging rust-openssl's built-in support for\nhostname verification.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "hyper",
        "purl": "pkg:cargo/hyper"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [
            "windows"
          ],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [
          "crypto-failure"
        ],
        "cvss": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
        "informational": null
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.9.4"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/hyper"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2016-0002.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hyperium/hyper/blob/master/CHANGELOG.md#v094-2016-05-09"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2016-0003](https://vulnerability.circl.lu/vuln/rustsec-2016-0003)

```json
{
  "id": "RUSTSEC-2016-0003",
  "modified": "2023-06-13T13:10:24Z",
  "published": "2016-08-01T12:00:00Z",
  "aliases": [
    "CVE-2016-10933",
    "GHSA-pq6v-x7gp-7776"
  ],
  "related": [],
  "summary": "HTTP download and execution allows MitM RCE",
  "details": "The build script in the portaudio crate will attempt to download via HTTP\nthe portaudio source and build it.\n\nA Mallory in the middle can intercept the download with their own archive\nand get RCE.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "portaudio",
        "purl": "pkg:cargo/portaudio"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
        "informational": null
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/portaudio"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2016-0003.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/RustAudio/rust-portaudio/issues/144"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2016-0005](https://vulnerability.circl.lu/vuln/rustsec-2016-0005)

```json
{
  "id": "RUSTSEC-2016-0005",
  "modified": "2022-01-09T20:07:15Z",
  "published": "2016-09-06T12:00:00Z",
  "aliases": [],
  "related": [],
  "summary": "rust-crypto is unmaintained; switch to a modern alternative",
  "details": "The `rust-crypto` crate has not seen a release or GitHub commit since 2016,\nand its author is unresponsive.\n\n*NOTE: The (old) `rust-crypto` crate (with hyphen) should not be confused with\nsimilarly named (new) [RustCrypto GitHub Org] (without hyphen). The GitHub Org\nis actively maintained.*\n\nWe recommend you switch to one of the following crates instead, depending on\nwhich algorithms you need:\n\n- [dalek-cryptography GitHub Org]:\n  - Key agreement: [`x25519-dalek`]\n  - Signature algorithms: [`ed25519-dalek`]\n- [`ring`]:\n  - AEAD algorithms: AES-GCM, ChaCha20Poly1305\n  - Digest algorithms: SHA-256, SHA-384, SHA-512, SHA-512/256 (legacy: SHA-1)\n  - HMAC\n  - Key agreement: ECDH (P-256, P-384), X25519\n  - Key derivation: HKDF\n  - Password hashing: PBKDF2\n  - Signature algorithms: ECDSA (P-256, P-384), Ed25519, RSA (PKCS#1v1.5, PSS)\n- [RustCrypto GitHub Org]:\n  - AEAD algorithms: [`aes-gcm`], [`aes-gcm-siv`], [`aes-siv`], [`chacha20poly1305`], [`xsalsa20poly1305`]\n  - Block ciphers: [`aes`], [`cast5`], [`des`]\n  - Digest algorithms: [`sha2`], [`sha3`], [`blake2`], [`ripemd160`]\n    (legacy: [`sha-1`], [`md-5`])\n  - Key derivation: [`hkdf`]\n  - MACs: [`cmac`], [`hmac`], [`pmac`], [`poly1305`]\n  - Password hashing: [`pbkdf2`]\n  - Stream ciphers: [`aes-ctr`], [`chacha20`], [`hc-256`], [`salsa20`]\n- [`secp256k1`]:\n  - Key agreement: ECDH (secp256k1 only)\n  - Signature algorithms: ECDSA (secp256k1 only)\n- [`orion`]:\n  - AEAD algorithms: ChaCha20Poly1305 (IETF version), XChaCha20Poly1305\n  - Digest algorithms: SHA-512, BLAKE2b\n  - Key derivation: HKDF\n  - MACs: HMAC, Poly1305\n  - Password hashing: PBKDF2\n  - Stream ciphers: ChaCha20 (IETF version), XChaCha20\n\n[dalek-cryptography GitHub Org]: https://github.com/dalek-cryptography\n[RustCrypto GitHub Org]: https://github.com/RustCrypto\n[`aes`]: https://crates.io/crates/aes\n[`aes-ctr`]: https://crates.io/crates/aes-ctr\n[`aes-gcm`]: https://crates.io/crates/aes-gcm\n[`aes-gcm-siv`]: https://crates.io/crates/aes-gcm-siv\n[`aes-siv`]: https://crates.io/crates/aes-siv\n[`blake2`]: https://crates.io/crates/blake2\n[`cast5`]: https://crates.io/crates/cast5\n[`chacha20`]: https://crates.io/crates/chacha20\n[`chacha20poly1305`]: https://crates.io/crates/chacha20poly1305\n[`cmac`]: https://crates.io/crates/cmac\n[`des`]: https://crates.io/crates/des\n[`ed25519-dalek`]: https://crates.io/crates/ed25519-dalek\n[`hc-256`]: https://crates.io/crates/hc-256\n[`hkdf`]: https://crates.io/crates/hkdf\n[`hmac`]: https://crates.io/crates/hmac\n[`pbkdf2`]: https://crates.io/crates/pbkdf2\n[`pmac`]: https://crates.io/crates/pmac\n[`poly1305`]: https://crates.io/crates/poly1305\n[`ring`]: https://crates.io/crates/ring\n[`ripemd160`]: https://crates.io/crates/ripemd160\n[`salsa20`]: https://crates.io/crates/salsa20\n[`secp256k1`]: https://crates.io/crates/secp256k1\n[`sha-1`]: https://crates.io/crates/sha-1\n[`sha2`]: https://crates.io/crates/sha2\n[`sha3`]: https://crates.io/crates/sha3\n[`x25519-dalek`]: https://crates.io/crates/x25519-dalek\n[`xsalsa20poly1305`]: https://crates.io/crates/xsalsa20poly1305\n[`orion`]: https://crates.io/crates/orion",
  "severity": [],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "rust-crypto",
        "purl": "pkg:cargo/rust-crypto"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": null,
        "informational": "unmaintained"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.2.37-0"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/rust-crypto"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2016-0005.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/DaGenix/rust-crypto/issues/440"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2016-0004](https://vulnerability.circl.lu/vuln/rustsec-2016-0004)

```json
{
  "id": "RUSTSEC-2016-0004",
  "modified": "2020-10-02T01:29:11Z",
  "published": "2016-09-10T12:00:00Z",
  "aliases": [],
  "related": [],
  "summary": "libusb is unmaintained; use rusb instead",
  "details": "The `libusb` crate has not seen a release since September 2016, and its author\nis unresponsive.\n\nThe `rusb` crate is a maintained fork:\n\nhttps://github.com/a1ien/rusb",
  "severity": [],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "libusb",
        "purl": "pkg:cargo/libusb"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": null,
        "informational": "unmaintained"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.3.1-0"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/libusb"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2016-0004.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/dcuddeback/libusb-rs/issues/33"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2016-0001](https://vulnerability.circl.lu/vuln/rustsec-2016-0001)

```json
{
  "id": "RUSTSEC-2016-0001",
  "modified": "2023-06-13T13:10:24Z",
  "published": "2016-11-05T12:00:00Z",
  "aliases": [
    "CVE-2016-10931",
    "GHSA-34p9-f4q3-c4r7"
  ],
  "related": [],
  "summary": "SSL/TLS MitM vulnerability due to insecure defaults",
  "details": "All versions of rust-openssl prior to 0.9.0 contained numerous insecure defaults\nincluding off-by-default certificate verification and no API to perform hostname\nverification.\n\nUnless configured correctly by a developer, these defaults could allow an attacker\nto perform man-in-the-middle attacks.\n\nThe problem was addressed in newer versions by enabling certificate verification\nby default and exposing APIs to perform hostname verification. Use the\n`SslConnector` and `SslAcceptor` types to take advantage of these new features\n(as opposed to the lower-level `SslContext` type).",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "openssl",
        "purl": "pkg:cargo/openssl"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
        "informational": null
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.9.0"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/openssl"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2016-0001.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sfackler/rust-openssl/releases/tag/v0.9.0"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2016-0006](https://vulnerability.circl.lu/vuln/rustsec-2016-0006)

```json
{
  "id": "RUSTSEC-2016-0006",
  "modified": "2020-10-02T01:29:11Z",
  "published": "2016-12-15T12:00:00Z",
  "aliases": [],
  "related": [],
  "summary": "`cassandra` crate is unmaintained; use `cassandra-cpp` instead",
  "details": "The `cassandra` crate has not seen a release since December 2016, and its author\nis unresponsive.\n\nThe `cassandra-cpp` crate is a maintained fork:\n\nhttps://github.com/Metaswitch/cassandra-rs",
  "severity": [],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "cassandra",
        "purl": "pkg:cargo/cassandra"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": null,
        "informational": "unmaintained"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.8.2-0"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/cassandra"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2016-0006.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/tupshin/cassandra-rs/issues/52"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2017-0002](https://vulnerability.circl.lu/vuln/rustsec-2017-0002)

```json
{
  "id": "RUSTSEC-2017-0002",
  "modified": "2023-06-13T13:10:24Z",
  "published": "2017-01-23T12:00:00Z",
  "aliases": [
    "CVE-2017-18587",
    "GHSA-q89x-f52w-6hj2"
  ],
  "related": [],
  "summary": "headers containing newline characters can split messages",
  "details": "Serializing of headers to the socket did not filter the values for newline bytes (`\\r` or `\\n`),\nwhich allowed for header values to split a request or response. People would not likely include\nnewlines in the headers in their own applications, so the way for most people to exploit this\nis if an application constructs headers based on unsanitized user input.\n\nThis issue was fixed by replacing all newline characters with a space during serialization of\na header value.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "hyper",
        "purl": "pkg:cargo/hyper"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
        "informational": null
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.9.18"
            },
            {
              "introduced": "0.10.0"
            },
            {
              "fixed": "0.10.2"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/hyper"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2017-0002.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hyperium/hyper/wiki/Security-001"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2017-0001](https://vulnerability.circl.lu/vuln/rustsec-2017-0001)

```json
{
  "id": "RUSTSEC-2017-0001",
  "modified": "2023-06-13T13:10:24Z",
  "published": "2017-01-26T12:00:00Z",
  "aliases": [
    "CVE-2017-1000168",
    "GHSA-2wc6-2rcj-8v76"
  ],
  "related": [],
  "summary": "scalarmult() vulnerable to degenerate public keys",
  "details": "The `scalarmult()` function included in previous versions of this crate\naccepted all-zero public keys, for which the resulting Diffie-Hellman shared\nsecret will always be zero regardless of the private key used.\n\nThis issue was fixed by checking for this class of keys and rejecting them\nif they are used.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "sodiumoxide",
        "purl": "pkg:cargo/sodiumoxide"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
        "informational": null
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.0.14"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/sodiumoxide"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2017-0001.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/dnaq/sodiumoxide/issues/154"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2017-0003](https://vulnerability.circl.lu/vuln/rustsec-2017-0003)

```json
{
  "id": "RUSTSEC-2017-0003",
  "modified": "2023-06-13T13:10:24Z",
  "published": "2017-03-15T12:00:00Z",
  "aliases": [
    "CVE-2017-18588",
    "GHSA-jqqr-c2r2-9cvr"
  ],
  "related": [],
  "summary": "Hostname verification skipped when custom root certs used",
  "details": "If custom root certificates were registered with a `ClientBuilder`, the\nhostname of the target server would not be validated against its presented leaf\ncertificate.\n\nThis issue was fixed by properly configuring the trust evaluation logic to\nperform that check.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "security-framework",
        "purl": "pkg:cargo/security-framework"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
        "informational": null
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.1.12"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/security-framework"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2017-0003.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sfackler/rust-security-framework/pull/27"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2017-0007](https://vulnerability.circl.lu/vuln/rustsec-2017-0007)

```json
{
  "id": "RUSTSEC-2017-0007",
  "modified": "2020-10-02T01:29:11Z",
  "published": "2017-04-17T12:00:00Z",
  "aliases": [],
  "related": [],
  "summary": "lz4-compress is unmaintained",
  "details": "[According to the developers](https://gitlab.redox-os.org/redox-os/tfs/issues/89) this crate is no longer maintained.\n\nThe suggested alternative is [`lz4-compression`](https://crates.io/crates/lz4-compression), a maintained fork of `lz4-compress`.\n\nSee also [lz-fear](https://crates.io/crates/lz-fear) which is compatible with the reference LZ4 implementation in C, but not with lz4-compress.",
  "severity": [],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "lz4-compress",
        "purl": "pkg:cargo/lz4-compress"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": null,
        "informational": "unmaintained"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/lz4-compress"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2017-0007.html"
    },
    {
      "type": "REPORT",
      "url": "https://gitlab.redox-os.org/redox-os/tfs/issues/89"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2017-0004](https://vulnerability.circl.lu/vuln/rustsec-2017-0004)

```json
{
  "id": "RUSTSEC-2017-0004",
  "modified": "2023-06-13T13:10:24Z",
  "published": "2017-05-03T12:00:00Z",
  "aliases": [
    "CVE-2017-1000430",
    "GHSA-x67x-vg9m-65c3"
  ],
  "related": [],
  "summary": "Integer overflow leads to heap-based buffer overflow in encode_config_buf",
  "details": "Affected versions of this crate suffered from an integer overflow bug when\ncalculating the size of a buffer to use when encoding base64 using the\n`encode_config_buf` and `encode_config` functions.  If the input string\nwas large, this would cause a buffer to be allocated that was too small.\nSince this function writes to the buffer using unsafe code, it would\nallow an attacker to write beyond the buffer, causing memory corruption\nand possibly the execution of arbitrary code.\n\nThis flaw was corrected by using checked arithmetic to calculate\nthe size of the buffer.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "base64",
        "purl": "pkg:cargo/base64"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
        "informational": null
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.5.2"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/base64"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2017-0004.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alicemaz/rust-base64/commit/24ead980daf11ba563e4fb2516187a56a71ad319"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2017-0005](https://vulnerability.circl.lu/vuln/rustsec-2017-0005)

```json
{
  "id": "RUSTSEC-2017-0005",
  "modified": "2023-06-13T13:10:24Z",
  "published": "2017-05-06T12:00:00Z",
  "aliases": [
    "CVE-2017-18589",
    "GHSA-vjrq-cg9x-rfjp"
  ],
  "related": [],
  "summary": "Large cookie Max-Age values can cause a denial of service",
  "details": "Affected versions of this crate use the `time` crate and the method\n`Duration::seconds` to parse the `Max-Age` duration cookie setting. This method\nwill panic if the value is greater than 2^64/1000 and less than or equal to\n2^64, which can result in denial of service for a client or server.\n\nThis flaw was corrected by explicitly checking for the `Max-Age` being in this\ninteger range and clamping the value to the maximum duration value.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "cookie",
        "purl": "pkg:cargo/cookie"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
        "informational": null
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.6.0"
            },
            {
              "fixed": "0.6.2"
            },
            {
              "introduced": "0.7.0-0"
            },
            {
              "fixed": "0.7.6"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/cookie"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2017-0005.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alexcrichton/cookie-rs/pull/86"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2017-0008](https://vulnerability.circl.lu/vuln/rustsec-2017-0008)

```json
{
  "id": "RUSTSEC-2017-0008",
  "modified": "2024-12-04T13:14:28Z",
  "published": "2017-07-02T12:00:00Z",
  "aliases": [],
  "related": [],
  "summary": "`serial` crate is unmaintained",
  "details": "The [`serial`](https://crates.io/crates/serial) crate is no longer maintained.\n\nLast release was on 2017-07-02.\n\n## Possible alternatives\n\nConsider using an alternative, for instance the blocking librarys:\n\n- [serial2](https://crates.io/crates/serial2)\n- [serialport](https://crates.io/crates/serialport)\n\nor async alternatives:\n\n- [mio-serial](https://crates.io/crates/mio-serial)\n- [tokio-serial](https://crates.io/crates/tokio-serial)",
  "severity": [],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "serial",
        "purl": "pkg:cargo/serial"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": null,
        "informational": "unmaintained"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/serial"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2017-0008.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/dcuddeback/serial-rs/issues/71"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2017-0006](https://vulnerability.circl.lu/vuln/rustsec-2017-0006)

```json
{
  "id": "RUSTSEC-2017-0006",
  "modified": "2023-06-13T13:10:24Z",
  "published": "2017-11-21T12:00:00Z",
  "aliases": [
    "GHSA-mcrf-7hf9-f6q5"
  ],
  "related": [],
  "summary": "Unchecked vector pre-allocation",
  "details": "Affected versions of this crate pre-allocate memory on deserializing raw\nbuffers without checking whether there is sufficient data available.\n\nThis allows an attacker to do denial-of-service attacks by sending small\nmsgpack messages that allocate gigabytes of memory.",
  "severity": [],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "rmpv",
        "purl": "pkg:cargo/rmpv"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [
          "denial-of-service"
        ],
        "cvss": null,
        "informational": null
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.4.2"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/rmpv"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2017-0006.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/3Hren/msgpack-rust/issues/151"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2018-0017](https://vulnerability.circl.lu/vuln/rustsec-2018-0017)

```json
{
  "id": "RUSTSEC-2018-0017",
  "modified": "2020-10-02T01:29:11Z",
  "published": "2018-02-13T12:00:00Z",
  "aliases": [],
  "related": [],
  "summary": "`tempdir` crate has been deprecated; use `tempfile` instead",
  "details": "The [`tempdir`](https://crates.io/crates/tempdir) crate has been deprecated\nand the functionality is merged into [`tempfile`](https://crates.io/crates/tempfile).",
  "severity": [],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "tempdir",
        "purl": "pkg:cargo/tempdir"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": null,
        "informational": "unmaintained"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/tempdir"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2018-0017.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rust-lang-deprecated/tempdir/pull/46"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2018-0010](https://vulnerability.circl.lu/vuln/rustsec-2018-0010)

```json
{
  "id": "RUSTSEC-2018-0010",
  "modified": "2023-06-13T13:10:24Z",
  "published": "2018-06-01T12:00:00Z",
  "aliases": [
    "CVE-2018-20997",
    "GHSA-xjxc-vfw2-cg96"
  ],
  "related": [],
  "summary": "Use after free in CMS Signing",
  "details": "Affected versions of the OpenSSL crate used structures after they'd been freed.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "openssl",
        "purl": "pkg:cargo/openssl"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
        "informational": null
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.10.8"
            },
            {
              "fixed": "0.10.9"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/openssl"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2018-0010.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sfackler/rust-openssl/pull/942"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2018-0019](https://vulnerability.circl.lu/vuln/rustsec-2018-0019)

```json
{
  "id": "RUSTSEC-2018-0019",
  "modified": "2026-06-01T14:16:58Z",
  "published": "2018-06-08T12:00:00Z",
  "aliases": [
    "CVE-2018-25024",
    "CVE-2018-25025",
    "CVE-2018-25026",
    "GHSA-7x36-h62w-vw65",
    "GHSA-9qj6-4rfq-vm84",
    "GHSA-fgfm-hqjw-3265",
    "GHSA-w65j-g6c7-g3m4"
  ],
  "related": [],
  "summary": "Multiple memory safety issues",
  "details": "Affected versions contain multiple memory safety issues, such as:\n\n - Unsoundly coercing immutable references to mutable references\n - Unsoundly extending lifetimes of strings\n - Adding the `Send` marker trait to objects that cannot be safely sent between threads\n\nThis may result in a variety of memory corruption scenarios, most likely use-after-free.\n \nA significant refactoring effort has been conducted to resolve these issues.",
  "severity": [],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "actix-web",
        "purl": "pkg:cargo/actix-web"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [
          "memory-corruption"
        ],
        "cvss": null,
        "informational": null
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.7.20-0"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/actix-web"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2018-0019.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/actix/actix-web/issues/289"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2018-0021](https://vulnerability.circl.lu/vuln/rustsec-2018-0021)

```json
{
  "id": "RUSTSEC-2018-0021",
  "modified": "2023-06-13T13:10:24Z",
  "published": "2018-06-15T12:00:00Z",
  "aliases": [
    "CVE-2018-25027",
    "CVE-2018-25028",
    "GHSA-ghpq-vjxw-ch5w",
    "GHSA-hxjf-h2mh-r6hj",
    "GHSA-jqpv-jm4m-86j9"
  ],
  "related": [],
  "summary": "Use-after-free with objects returned by `Stream`'s `get_format_info` and `get_context` methods",
  "details": "Affected versions contained a pair of use-after-free issues with the objects returned by the `get_format_info` and `get_context` methods of `Stream` objects. These objects were mistakenly being constructed without setting an important flag to prevent destruction of the underlying C objects they reference upon their own destruction.",
  "severity": [],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "libpulse-binding",
        "purl": "pkg:cargo/libpulse-binding"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": [
            "libpulse_binding::stream::Stream::get_context",
            "libpulse_binding::stream::Stream::get_format_info"
          ]
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [
          "memory-corruption"
        ],
        "cvss": null,
        "informational": null
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "1.2.1"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/libpulse-binding"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2018-0021.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/jnqnfe/pulse-binding-rust/security/advisories/GHSA-ghpq-vjxw-ch5w"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2018-0001](https://vulnerability.circl.lu/vuln/rustsec-2018-0001)

```json
{
  "id": "RUSTSEC-2018-0001",
  "modified": "2023-06-13T13:10:24Z",
  "published": "2018-06-21T12:00:00Z",
  "aliases": [
    "CVE-2018-20989",
    "GHSA-wq8f-46ww-6c2h"
  ],
  "related": [],
  "summary": "An integer underflow could lead to panic",
  "details": "A mistake in error handling in untrusted before 0.6.2 could lead to an integer\nunderflow and panic if a user of the crate didn't properly check for errors\nreturned by untrusted.\n\nCombination of these two programming errors (one in untrusted and another by\nuser of this crate) could lead to a panic and maybe a denial of service of\naffected software.\n\nThe error in untrusted is fixed in release 0.6.2 released 2018-06-21. It's also\nadvisable that users of untrusted check for their sources for cases where errors\nreturned by untrusted are not handled correctly.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "untrusted",
        "purl": "pkg:cargo/untrusted"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
        "informational": null
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.6.2"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/untrusted"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2018-0001.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/briansmith/untrusted/pull/20"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2018-0002](https://vulnerability.circl.lu/vuln/rustsec-2018-0002)

```json
{
  "id": "RUSTSEC-2018-0002",
  "modified": "2023-06-13T13:10:24Z",
  "published": "2018-06-29T12:00:00Z",
  "aliases": [
    "CVE-2018-20990",
    "GHSA-2367-c296-3mp2"
  ],
  "related": [],
  "summary": "Links in archives can overwrite any existing file",
  "details": "When unpacking a tarball with the `unpack_in`-family of functions it's intended\nthat only files within the specified directory are able to be written. Tarballs\nwith hard links or symlinks, however, can be used to overwrite any file on the\nfilesystem.\n\nTarballs can contain multiple entries for the same file. A tarball which first\ncontains an entry for a hard link or symlink pointing to any file on the\nfilesystem will have the link created, and then afterwards if the same file is\nlisted in the tarball the hard link will be rewritten and any file can be\nrewritten on the filesystem.\n\nThis has been fixed in https://github.com/alexcrichton/tar-rs/pull/156 and is\npublished as `tar` 0.4.16. Thanks to Max Justicz for discovering this and\nemailing about the issue!",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "tar",
        "purl": "pkg:cargo/tar"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
        "informational": null
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.4.16"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/tar"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2018-0002.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alexcrichton/tar-rs/pull/156"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2018-0016](https://vulnerability.circl.lu/vuln/rustsec-2018-0016)

```json
{
  "id": "RUSTSEC-2018-0016",
  "modified": "2020-10-02T01:29:11Z",
  "published": "2018-06-30T12:00:00Z",
  "aliases": [],
  "related": [],
  "summary": "quickersort is deprecated and unmaintained",
  "details": "The author of the `quickersort` crate has deprecated it and does not recommend using it anymore.\n\nEverything in it has been incorporated into [std::sort_unstable] in the standard library as of Rust 1.20.\n\n[std::sort_unstable]: https://doc.rust-lang.org/stable/std/primitive.slice.html#method.sort_unstable",
  "severity": [],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "quickersort",
        "purl": "pkg:cargo/quickersort"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": null,
        "informational": "unmaintained"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "3.0.2-0"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/quickersort"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2018-0016.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/notriddle/quickersort/commit/0bc164366315801f0c6b31f4081b7df9fc894076"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2018-0003](https://vulnerability.circl.lu/vuln/rustsec-2018-0003)

```json
{
  "id": "RUSTSEC-2018-0003",
  "modified": "2026-07-17T15:52:38Z",
  "published": "2018-07-19T12:00:00Z",
  "aliases": [
    "CVE-2018-20991",
    "GHSA-rxr4-x558-x7hw"
  ],
  "related": [],
  "summary": "Possible double free during unwinding in SmallVec::insert_many",
  "details": "If an iterator passed to `SmallVec::insert_many` panicked in `Iterator::next`,\ndestructors were run during unwinding while the vector was in an inconsistent\nstate, possibly causing a double free (a destructor running on two copies of\nthe same value).\n\nThis is fixed in smallvec 0.6.3 by ensuring that the vector's length is not\nupdated to include moved items until they have been removed from their\noriginal positions.  Items may now be leaked if `Iterator::next` panics, but\nthey will not be dropped more than once.\n\nThank you to [@Vurich](https://github.com/Vurich) for reporting this bug.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "smallvec",
        "purl": "pkg:cargo/smallvec"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
        "informational": null
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.3.2"
            },
            {
              "fixed": "0.3.4"
            },
            {
              "introduced": "0.4.0-0"
            },
            {
              "fixed": "0.4.5"
            },
            {
              "introduced": "0.5.0-0"
            },
            {
              "fixed": "0.5.1"
            },
            {
              "introduced": "0.6.0-0"
            },
            {
              "fixed": "0.6.3"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/smallvec"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2018-0003.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/servo/rust-smallvec/issues/96"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2018-0014](https://vulnerability.circl.lu/vuln/rustsec-2018-0014)

```json
{
  "id": "RUSTSEC-2018-0014",
  "modified": "2020-10-02T01:29:11Z",
  "published": "2018-07-31T12:00:00Z",
  "aliases": [],
  "related": [],
  "summary": "chan is end-of-life; use crossbeam-channel instead",
  "details": "**`chan` has reached its end-of-life and is now deprecated.**\n\nThe intended successor of this crate is\n[`crossbeam-channel`](https://github.com/crossbeam-rs/crossbeam/tree/master/crossbeam-channel).\nIts API is strikingly similar, but comes with a much better `select!` macro,\nbetter performance, a better test suite and an all-around better\nimplementation.",
  "severity": [],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "chan",
        "purl": "pkg:cargo/chan"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": null,
        "informational": "unmaintained"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.1.24-0"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/chan"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2018-0014.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BurntSushi/chan/commit/0a5c0d4ad4adc90a54ee04a427389acf2e157275"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2018-0022](https://vulnerability.circl.lu/vuln/rustsec-2018-0022)

```json
{
  "id": "RUSTSEC-2018-0022",
  "modified": "2023-06-13T13:10:24Z",
  "published": "2018-08-22T12:00:00Z",
  "aliases": [
    "GHSA-2jq9-6xx7-3h29"
  ],
  "related": [],
  "summary": "Use of uninitialized memory in temporary",
  "details": "Uninit memory is used as a RNG seed in temporary\n\nThe following function is used as a way to get entropy from the system, which does operations on and exposes uninit memory, which is UB.\n\n```rust\nfn random_seed(_: &Path, _: &str) -> [u64; 2] {\n    use std::mem::uninitialized as rand;\n    unsafe { [rand::<u64>() ^ 0x12345678, rand::<u64>() ^ 0x87654321] }\n}\n```\n\nThis has been resolved in the 0.6.4 release.\n\nThe crate is not intended to be used outside of a testing environment.\n\nFor a general purpose crate to create temporary directories, [`tempfile`](https://crates.io/crates/tempfile) is an alternative for this crate.",
  "severity": [],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "temporary",
        "purl": "pkg:cargo/temporary"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [
          "memory-exposure"
        ],
        "cvss": null,
        "informational": null
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.3.0"
            },
            {
              "fixed": "0.6.4"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/temporary"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2018-0022.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/stainless-steel/temporary/issues/2"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2018-0004](https://vulnerability.circl.lu/vuln/rustsec-2018-0004)

```json
{
  "id": "RUSTSEC-2018-0004",
  "modified": "2023-06-13T13:10:24Z",
  "published": "2018-08-25T12:00:00Z",
  "aliases": [
    "CVE-2018-20992",
    "GHSA-8c6g-4xc5-w96c"
  ],
  "related": [],
  "summary": "Malicious input could cause uninitialized memory to be exposed",
  "details": "Affected versions of Claxon made an invalid assumption about the decode buffer\nsize being a multiple of a value read from the bitstream. This could cause parts\nof the decode buffer to not be overwritten. If the decode buffer was newly\nallocated and uninitialized, this uninitialized memory could be exposed.\n\nThis allows an attacker to observe parts of the uninitialized memory in the\ndecoded audio stream.\n\nThe flaw was corrected by checking that the value read from the bitstream divides\nthe decode buffer size, and returning a format error if it does not. If an error\nis returned, the decode buffer is not exposed. Regression tests and an\nadditional fuzzer have been added to prevent similar flaws in the future.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "claxon",
        "purl": "pkg:cargo/claxon"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
        "informational": null
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.3.2"
            },
            {
              "introduced": "0.4.0-0"
            },
            {
              "fixed": "0.4.1"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/claxon"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2018-0004.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ruuda/claxon/commit/8f28ec275e412dd3af4f3cda460605512faf332c"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2018-0005](https://vulnerability.circl.lu/vuln/rustsec-2018-0005)

```json
{
  "id": "RUSTSEC-2018-0005",
  "modified": "2023-06-13T13:10:24Z",
  "published": "2018-09-17T12:00:00Z",
  "aliases": [
    "GHSA-39vw-qp34-rmwf"
  ],
  "related": [],
  "summary": "Uncontrolled recursion leads to abort in deserialization",
  "details": "Affected versions of this crate did not properly check for recursion\nwhile deserializing aliases.\n\nThis allows an attacker to make a YAML file with an alias referring\nto itself causing an abort.\n\nThe flaw was corrected by checking the recursion depth.",
  "severity": [],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "serde_yaml",
        "purl": "pkg:cargo/serde_yaml"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": null,
        "informational": null
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.6.0-rc1"
            },
            {
              "fixed": "0.8.4"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/serde_yaml"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2018-0005.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dtolnay/serde-yaml/pull/105"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2018-0006](https://vulnerability.circl.lu/vuln/rustsec-2018-0006)

```json
{
  "id": "RUSTSEC-2018-0006",
  "modified": "2023-06-13T13:10:24Z",
  "published": "2018-09-17T12:00:00Z",
  "aliases": [
    "CVE-2018-20993",
    "GHSA-hv87-47h9-jcvq"
  ],
  "related": [],
  "summary": "Uncontrolled recursion leads to abort in deserialization",
  "details": "Affected versions of this crate did not prevent deep recursion while\ndeserializing data structures.\n\nThis allows an attacker to make a YAML file with deeply nested structures\nthat causes an abort while deserializing it.\n\nThe flaw was corrected by checking the recursion depth.\n\nNote: `clap 2.33` is not affected by this because it uses `yaml-rust`\nin a way that doesn't trigger the vulnerability. More specifically:\n\n1. The input to the YAML parser is always trusted - is included at compile\ntime via `include_str!`.\n\n2. The nesting level is never deep enough to trigger the overflow in practice\n(at most 5).",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "yaml-rust",
        "purl": "pkg:cargo/yaml-rust"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
        "informational": null
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.4.1"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/yaml-rust"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2018-0006.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/chyh1990/yaml-rust/pull/109"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2018-0018](https://vulnerability.circl.lu/vuln/rustsec-2018-0018)

```json
{
  "id": "RUSTSEC-2018-0018",
  "modified": "2023-06-13T13:10:24Z",
  "published": "2018-09-25T12:00:00Z",
  "aliases": [
    "CVE-2018-25023",
    "GHSA-55m5-whcv-c49c",
    "GHSA-66p5-j55p-32r9"
  ],
  "related": [],
  "summary": "smallvec creates uninitialized value of any type",
  "details": "Affected versions of this crate called `mem::uninitialized()` to create values of a user-supplied type `T`.\nThis is unsound e.g. if `T` is a reference type (which must be non-null and thus may not remain uninitialized).\n \nThe flaw was corrected by avoiding the use of `mem::uninitialized()`, using `MaybeUninit` instead.",
  "severity": [],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "smallvec",
        "purl": "pkg:cargo/smallvec"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": null,
        "informational": "unsound"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.6.13"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/smallvec"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2018-0018.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/servo/rust-smallvec/issues/126"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2018-0007](https://vulnerability.circl.lu/vuln/rustsec-2018-0007)

```json
{
  "id": "RUSTSEC-2018-0007",
  "modified": "2023-06-13T13:10:24Z",
  "published": "2018-10-09T12:00:00Z",
  "aliases": [
    "CVE-2018-20994",
    "GHSA-369h-pjr2-6wrh"
  ],
  "related": [],
  "summary": "Stack overflow when parsing malicious DNS packet",
  "details": "There's a stack overflow leading to a crash when Trust-DNS's parses a\nmalicious DNS packet.\n\nAffected versions of this crate did not properly handle parsing of DNS message\ncompression (RFC1035 section 4.1.4). The parser could be tricked into infinite\nloop when a compression offset pointed back to the same domain name to be\nparsed.\n\nThis allows an attacker to craft a malicious DNS packet which when consumed\nwith Trust-DNS could cause stack overflow and crash the affected software.\n\nThe flaw was corrected by trust-dns-proto 0.4.3 and upcoming 0.5.0 release.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "trust-dns-proto",
        "purl": "pkg:cargo/trust-dns-proto"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
        "informational": null
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.4.3"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/trust-dns-proto"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2018-0007.html"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```

## [rustsec-2018-0015](https://vulnerability.circl.lu/vuln/rustsec-2018-0015)

```json
{
  "id": "RUSTSEC-2018-0015",
  "modified": "2020-10-02T01:29:11Z",
  "published": "2018-11-19T12:00:00Z",
  "aliases": [],
  "related": [],
  "summary": "term is looking for a new maintainer",
  "details": "The author of the `term` crate does not have time to maintain it and is looking\nfor a new maintainer.\n\nSome maintained alternatives you can potentially switch to instead, depending\non your needs:\n\n- [`crossterm`](https://github.com/crossterm-rs/crossterm)\n- [`termcolor`](https://crates.io/crates/termcolor)\n- [`yansi`](https://crates.io/crates/yansi)",
  "severity": [],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "term",
        "purl": "pkg:cargo/term"
      },
      "ecosystem_specific": {
        "affects": {
          "arch": [],
          "os": [],
          "functions": []
        },
        "affected_functions": null
      },
      "database_specific": {
        "categories": [],
        "cvss": null,
        "informational": "unmaintained"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.6.2-0"
            }
          ]
        }
      ],
      "versions": []
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/term"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2018-0015.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/Stebalien/term/issues/93"
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  }
}
```