{"uuid": "84d59275-46b9-4735-856b-dd1916efc7fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-434x-w66g-qw3r", "type": "seen", "source": "https://gist.github.com/moonpiedumplings/7e71121b76c58ecaba4176be9bb827c4", "content": "[nix-shell:~/Projects/temp/radicle-tui]$ cargo-audit audit\n    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`\n      Loaded 1138 security advisories (from /home/moonpie/.cargo/advisory-db)\n    Updating crates.io index\n    Scanning Cargo.lock for vulnerabilities (435 crate dependencies)\nCrate:     bytes\nVersion:   1.10.1\nTitle:     Integer overflow in `BytesMut::reserve`\nDate:      2026-02-03\nID:        RUSTSEC-2026-0007\nURL:       https://github.com/advisories/GHSA-434x-w66g-qw3r\nSolution:  Upgrade to >=1.11.1\nDependency tree:\nbytes 1.10.1\n\u251c\u2500\u2500 tokio-util 0.7.17\n\u2502   \u2514\u2500\u2500 radicle-tui 0.7.0\n\u2514\u2500\u2500 tokio 1.48.0\n    \u251c\u2500\u2500 tokio-util 0.7.17\n    \u2514\u2500\u2500 radicle-tui 0.7.0\n\nCrate:     rsa\nVersion:   0.9.8\nTitle:     Marvin Attack: potential key recovery through timing sidechannels\nDate:      2023-11-22\nID:        RUSTSEC-2023-0071\nURL:       https://rustsec.org/advisories/RUSTSEC-2023-0071\nSeverity:  5.9 (medium)\nSolution:  No fixed upgrade is available!\nDependency tree:\nrsa 0.9.8\n\u2514\u2500\u2500 ssh-key 0.6.7\n    \u2514\u2500\u2500 radicle-crypto 0.14.0\n        \u251c\u2500\u2500 radicle-cob 0.17.0\n        \u2502   \u251c\u2500\u2500 radicle-cli 0.17.0\n        \u2502   \u2502   \u2514\u2500\u2500 radicle-tui 0.7.0\n        \u2502   \u2514\u2500\u2500 radicle 0.20.0\n        \u2502       \u251c\u2500\u2500 radicle-tui 0.7.0\n        \u2502       \u2514\u2500\u2500 radicle-cli 0.17.0\n        \u251c\u2500\u2500 radicle-cli 0.17.0\n        \u2514\u2500\u2500 radicle 0.20.0\n\nCrate:     tar\nVersion:   0.4.44\nTitle:     `unpack_in` can chmod arbitrary directories by following symlinks\nDate:      2026-03-19\nID:        RUSTSEC-2026-0067\nURL:       https://rustsec.org/advisories/RUSTSEC-2026-0067\nSeverity:  5.1 (medium)\nSolution:  Upgrade to >=0.4.45\nDependency tree:\ntar 0.4.44\n\u2514\u2500\u2500 radicle-surf 0.22.1\n    \u251c\u2500\u2500 radicle-tui 0.7.0\n    \u2514\u2500\u2500 radicle-cli 0.17.0\n        \u2514\u2500\u2500 radicle-tui 0.7.0\n\nCrate:     tar\nVersion:   0.4.44\nTitle:     tar-rs incorrectly ignores PAX size headers if header size is nonzero\nDate:      2026-03-19\nID:        RUSTSEC-2026-0068\nURL:       https://rustsec.org/advisories/RUSTSEC-2026-0068\nSeverity:  5.1 (medium)\nSolution:  Upgrade to >=0.4.45\n\nCrate:     time\nVersion:   0.3.42\nTitle:     Denial of Service via Stack Exhaustion\nDate:      2026-02-05\nID:        RUSTSEC-2026-0009\nURL:       https://rustsec.org/advisories/RUSTSEC-2026-0009\nSeverity:  6.8 (medium)\nSolution:  Upgrade to >=0.3.47\nDependency tree:\ntime 0.3.42\n\u251c\u2500\u2500 ratatui 0.29.0\n\u2502   \u251c\u2500\u2500 tui-tree-widget 0.23.1\n\u2502   \u2502   \u2514\u2500\u2500 radicle-tui 0.7.0\n\u2502   \u251c\u2500\u2500 tui-textarea 0.7.0\n\u2502   \u2502   \u2514\u2500\u2500 radicle-tui 0.7.0\n\u2502   \u251c\u2500\u2500 radicle-tui 0.7.0\n\u2502   \u2514\u2500\u2500 ansi-to-tui 7.0.0\n\u2502       \u2514\u2500\u2500 radicle-tui 0.7.0\n\u2514\u2500\u2500 plist 1.8.0\n    \u2514\u2500\u2500 os_info 3.12.0\n        \u2514\u2500\u2500 human-panic 2.0.4\n            \u2514\u2500\u2500 radicle-cli 0.17.0\n                \u2514\u2500\u2500 radicle-tui 0.7.0\n\nCrate:     fxhash\nVersion:   0.2.1\nWarning:   unmaintained\nTitle:     fxhash - no longer maintained\nDate:      2025-09-05\nID:        RUSTSEC-2025-0057\nURL:       https://rustsec.org/advisories/RUSTSEC-2025-0057\nDependency tree:\nfxhash 0.2.1\n\u2514\u2500\u2500 inquire 0.7.5\n    \u2514\u2500\u2500 radicle-term 0.16.0\n        \u251c\u2500\u2500 radicle-tui 0.7.0\n        \u2514\u2500\u2500 radicle-cli 0.17.0\n            \u2514\u2500\u2500 radicle-tui 0.7.0\n\nCrate:     paste\nVersion:   1.0.15\nWarning:   unmaintained\nTitle:     paste - no longer maintained\nDate:      2024-10-07\nID:        RUSTSEC-2024-0436\nURL:       https://rustsec.org/advisories/RUSTSEC-2024-0436\nDependency tree:\npaste 1.0.15\n\u2514\u2500\u2500 ratatui 0.29.0\n    \u251c\u2500\u2500 tui-tree-widget 0.23.1\n    \u2502   \u2514\u2500\u2500 radicle-tui 0.7.0\n    \u251c\u2500\u2500 tui-textarea 0.7.0\n    \u2502   \u2514\u2500\u2500 radicle-tui 0.7.0\n    \u251c\u2500\u2500 radicle-tui 0.7.0\n    \u2514\u2500\u2500 ansi-to-tui 7.0.0\n        \u2514\u2500\u2500 radicle-tui 0.7.0\n\nCrate:     proc-macro-error\nVersion:   1.0.4\nWarning:   unmaintained\nTitle:     proc-macro-error is unmaintained\nDate:      2024-09-01\nID:        RUSTSEC-2024-0370\nURL:       https://rustsec.org/advisories/RUSTSEC-2024-0370\nDependency tree:\nproc-macro-error 1.0.4\n\u2514\u2500\u2500 git-ref-format-macro 0.3.1\n    \u2514\u2500\u2500 git-ref-format 0.3.1\n        \u251c\u2500\u2500 radicle-git-ext 0.8.1\n        \u2502   \u251c\u2500\u2500 radicle-tui 0.7.0\n        \u2502   \u251c\u2500\u2500 radicle-surf 0.22.1\n        \u2502   \u2502   \u251c\u2500\u2500 radicle-tui 0.7.0\n        \u2502   \u2502   \u2514\u2500\u2500 radicle-cli 0.17.0\n        \u2502   \u2502       \u2514\u2500\u2500 radicle-tui 0.7.0\n        \u2502   \u251c\u2500\u2500 radicle-crypto 0.14.0\n        \u2502   \u2502   \u251c\u2500\u2500 radicle-cob 0.17.0\n        \u2502   \u2502   \u2502   \u251c\u2500\u2500 radicle-cli 0.17.0\n        \u2502   \u2502   \u2502   \u2514\u2500\u2500 radicle 0.20.0\n        \u2502   \u2502   \u2502       \u251c\u2500\u2500 radicle-tui 0.7.0\n        \u2502   \u2502   \u2502       \u2514\u2500\u2500 radicle-cli 0.17.0\n        \u2502   \u2502   \u251c\u2500\u2500 radicle-cli 0.17.0\n        \u2502   \u2502   \u2514\u2500\u2500 radicle 0.20.0\n        \u2502   \u251c\u2500\u2500 radicle-cob 0.17.0\n        \u2502   \u251c\u2500\u2500 radicle-cli 0.17.0\n        \u2502   \u2514\u2500\u2500 radicle 0.20.0\n        \u2514\u2500\u2500 radicle-cli 0.17.0\n\nCrate:     git2\nVersion:   0.19.0\nWarning:   unsound\nTitle:     Potential undefined behavior when dereferencing Buf struct\nDate:      2026-02-02\nID:        RUSTSEC-2026-0008\nURL:       https://rustsec.org/advisories/RUSTSEC-2026-0008\nDependency tree:\ngit2 0.19.0\n\u251c\u2500\u2500 radicle-tui 0.7.0\n\u251c\u2500\u2500 radicle-term 0.16.0\n\u2502   \u251c\u2500\u2500 radicle-tui 0.7.0\n\u2502   \u2514\u2500\u2500 radicle-cli 0.17.0\n\u2502       \u2514\u2500\u2500 radicle-tui 0.7.0\n\u251c\u2500\u2500 radicle-surf 0.22.1\n\u2502   \u251c\u2500\u2500 radicle-tui 0.7.0\n\u2502   \u2514\u2500\u2500 radicle-cli 0.17.0\n\u251c\u2500\u2500 radicle-git-ext 0.8.1\n\u2502   \u251c\u2500\u2500 radicle-tui 0.7.0\n\u2502   \u251c\u2500\u2500 radicle-surf 0.22.1\n\u2502   \u251c\u2500\u2500 radicle-crypto 0.14.0\n\u2502   \u2502   \u251c\u2500\u2500 radicle-cob 0.17.0\n\u2502   \u2502   \u2502   \u251c\u2500\u2500 radicle-cli 0.17.0\n\u2502   \u2502   \u2502   \u2514\u2500\u2500 radicle 0.20.0\n\u2502   \u2502   \u2502       \u251c\u2500\u2500 radicle-tui 0.7.0\n\u2502   \u2502   \u2502       \u2514\u2500\u2500 radicle-cli 0.17.0\n\u2502   \u2502   \u251c\u2500\u2500 radicle-cli 0.17.0\n\u2502   \u2502   \u2514\u2500\u2500 radicle 0.20.0\n\u2502   \u251c\u2500\u2500 radicle-cob 0.17.0\n\u2502   \u251c\u2500\u2500 radicle-cli 0.17.0\n\u2502   \u2514\u2500\u2500 radicle 0.20.0\n\u251c\u2500\u2500 radicle-cob 0.17.0\n\u2514\u2500\u2500 radicle 0.20.0\n\nCrate:     git2\nVersion:   0.19.0\nWarning:   unsound\nTitle:     Potential undefined behavior when calling Remote::list()\nDate:      2026-05-12\nID:        RUSTSEC-2026-0183\nURL:       https://rustsec.org/advisories/RUSTSEC-2026-0183\n\nCrate:     git2\nVersion:   0.19.0\nWarning:   unsound\nTitle:     Potential undefined behavior with Signature from a buffer-created BlameHunk\nDate:      2026-05-13\nID:        RUSTSEC-2026-0184\nURL:       https://rustsec.org/advisories/RUSTSEC-2026-0184\n\nCrate:     keccak\nVersion:   0.1.5\nWarning:   unsound\nTitle:     Unsoundness in opt-in ARMv8 assembly backend for `keccak`\nDate:      2026-02-12\nID:        RUSTSEC-2026-0012\nURL:       https://rustsec.org/advisories/RUSTSEC-2026-0012\nDependency tree:\nkeccak 0.1.5\n\u2514\u2500\u2500 sha3 0.10.8\n    \u2514\u2500\u2500 cypheraddr 0.4.0\n        \u251c\u2500\u2500 socks5-client 0.4.1\n        \u2502   \u2514\u2500\u2500 cyphernet 0.5.2\n        \u2502       \u251c\u2500\u2500 radicle-crypto 0.14.0\n        \u2502       \u2502   \u251c\u2500\u2500 radicle-cob 0.17.0\n        \u2502       \u2502   \u2502   \u251c\u2500\u2500 radicle-cli 0.17.0\n        \u2502       \u2502   \u2502   \u2502   \u2514\u2500\u2500 radicle-tui 0.7.0\n        \u2502       \u2502   \u2502   \u2514\u2500\u2500 radicle 0.20.0\n        \u2502       \u2502   \u2502       \u251c\u2500\u2500 radicle-tui 0.7.0\n        \u2502       \u2502   \u2502       \u2514\u2500\u2500 radicle-cli 0.17.0\n        \u2502       \u2502   \u251c\u2500\u2500 radicle-cli 0.17.0\n        \u2502       \u2502   \u2514\u2500\u2500 radicle 0.20.0\n        \u2502       \u2514\u2500\u2500 radicle 0.20.0\n        \u2514\u2500\u2500 cyphernet 0.5.2\n\nCrate:     lru\nVersion:   0.12.5\nWarning:   unsound\nTitle:     `IterMut` violates Stacked Borrows by invalidating internal pointer\nDate:      2026-01-07\nID:        RUSTSEC-2026-0002\nURL:       https://rustsec.org/advisories/RUSTSEC-2026-0002\nDependency tree:\nlru 0.12.5\n\u2514\u2500\u2500 ratatui 0.29.0\n    \u251c\u2500\u2500 tui-tree-widget 0.23.1\n    \u2502   \u2514\u2500\u2500 radicle-tui 0.7.0\n    \u251c\u2500\u2500 tui-textarea 0.7.0\n    \u2502   \u2514\u2500\u2500 radicle-tui 0.7.0\n    \u251c\u2500\u2500 radicle-tui 0.7.0\n    \u2514\u2500\u2500 ansi-to-tui 7.0.0\n        \u2514\u2500\u2500 radicle-tui 0.7.0\n\nCrate:     rand\nVersion:   0.8.5\nWarning:   unsound\nTitle:     Rand is unsound with a custom logger using `rand::rng()`\nDate:      2026-04-09\nID:        RUSTSEC-2026-0097\nURL:       https://rustsec.org/advisories/RUSTSEC-2026-0097\nDependency tree:\nrand 0.8.5\n\u251c\u2500\u2500 winpipe 0.1.1\n\u2502   \u251c\u2500\u2500 radicle-ssh 0.10.0\n\u2502   \u2502   \u251c\u2500\u2500 radicle-crypto 0.14.0\n\u2502   \u2502   \u2502   \u251c\u2500\u2500 radicle-cob 0.17.0\n\u2502   \u2502   \u2502   \u2502   \u251c\u2500\u2500 radicle-cli 0.17.0\n\u2502   \u2502   \u2502   \u2502   \u2502   \u2514\u2500\u2500 radicle-tui 0.7.0\n\u2502   \u2502   \u2502   \u2502   \u2514\u2500\u2500 radicle 0.20.0\n\u2502   \u2502   \u2502   \u2502       \u251c\u2500\u2500 radicle-tui 0.7.0\n\u2502   \u2502   \u2502   \u2502       \u2514\u2500\u2500 radicle-cli 0.17.0\n\u2502   \u2502   \u2502   \u251c\u2500\u2500 radicle-cli 0.17.0\n\u2502   \u2502   \u2502   \u2514\u2500\u2500 radicle 0.20.0\n\u2502   \u2502   \u2514\u2500\u2500 radicle 0.20.0\n\u2502   \u2514\u2500\u2500 radicle 0.20.0\n\u251c\u2500\u2500 qcheck 1.0.0\n\u2502   \u251c\u2500\u2500 radicle-crypto 0.14.0\n\u2502   \u2514\u2500\u2500 radicle 0.20.0\n\u2514\u2500\u2500 num-bigint-dig 0.8.4\n    \u2514\u2500\u2500 rsa 0.9.8\n        \u2514\u2500\u2500 ssh-key 0.6.7\n            \u2514\u2500\u2500 radicle-crypto 0.14.0\n\nCrate:     keccak\nVersion:   0.1.5\nWarning:   yanked\n\nerror: 5 vulnerabilities found!\nwarning: 10 allowed warnings found\n\n", "creation_timestamp": "2026-06-24T21:41:59.735450Z"}