TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-vr8q-g5c7-m54m
Summary: XXE in Nokogiri
Aliases: CVE-2020-26247
Severity: MODERATE
CWE: CWE-611
Published: 2020-12-30T18:35:06Z

### Severity

Nokogiri maintainers have evaluated this as [__Low Severity__ (CVSS3 2.6)](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N).


### Description

In Nokogiri versions <= 1.11.0.rc3, XML Schemas parsed by `Nokogiri::XML::Schema` are **trusted** by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks.

This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as **untrusted** by default whenever possible.

Please note that this security fix was pushed into a new minor version, 1.11.x, rather than a patch release to the 1.10.x branch, because it is a breaking change for some schemas and the risk was assessed to be "Low Severity".


### Affected Versions

Nokogiri `<= 1.10.10` as well as prereleases `1.11.0.rc1`, `1.11.0.rc2`, and `1.11.0.rc3`


### Mitigation

There are no known workarounds for affected versions. Upgrade to Nokogiri `1.11.0.rc4` or later.

If, after upgrading to `1.11.0.rc4` or later, you wish to re-enable network access for resolution of external resources (i.e., return to the previous behavior):

1. Ensure the input is trusted. Do not enable this option for untrusted input.
2. When invoking the `Nokogiri::XML::Schema` constructor, pass as the second parameter an instance of `Nokogiri::XML::ParseOptions` with the `NONET` flag turned off.

So if your previous code was:

``` ruby
# in v1.11.0.rc3 and earlier, this call allows resources to be accessed over the network
# but in v1.11.0.rc4 and later, this call will disallow network access for external resources
schema = Nokogiri::XML::Schema.new(schema)

# in v1.11.0.rc4 and later, the following is equivalent to the code above
# (the second parameter is optional, and this demonstrates its default value)
schema = Nokogiri::XML::Schema.new(schema, Nokogiri::XML::ParseOptions::DEFAULT_SCHEMA)
```

Then you can add the second parameter to indicate that the input is trusted by changing it to:

``` ruby
# in v1.11.0.rc3 and earlier, this would raise an ArgumentError 
# but in v1.11.0.rc4 and later, this allows resources to be accessed over the network
schema = Nokogiri::XML::Schema.new(trusted_schema, Nokogiri::XML::ParseOptions.new.nononet)
```


### References

- [This issue's public advisory](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54m)
- [Original Hackerone report (private)](https://hackerone.com/reports/747489)
- [OWASP description of XXE attack](https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing)
- [OWASP description of SSRF attack](https://www.owasp.org/index.php/Server_Side_Request_Forgery)


### Credit 

This vulnerability was independently reported by @eric-therond and @gucki.

The Nokogiri maintainers would like to thank [HackerOne](https://hackerone.com/nokogiri) for providing a secure, responsible mechanism for reporting, and for providing their fantastic service to us.
Vulnerability: GHSA-cf3w-g86h-35x4
Summary: Code Injection vulnerability in CarrierWave::RMagick
Aliases: CVE-2021-21305
Severity: HIGH
CWE: CWE-94, CWE-74
Published: 2021-02-08T19:16:39Z

### Impact
[CarrierWave::RMagick](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/processing/rmagick.rb) has a Code Injection vulnerability. Its `#manipulate!` method inappropriately evals the content of mutation option(`:read`/`:write`), allowing attackers to craft a string that can be executed as a Ruby code.
If an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE).

(But supplying untrusted input to the option itself is dangerous even in absence of this vulnerability, since is prone to DoS vulnerability - attackers can try to consume massive amounts of memory by resizing to a very large dimension)

### Proof of Concept
```ruby
class MyUploader < CarrierWave::Uploader::Base
  include CarrierWave::RMagick
end

MyUploader.new.manipulate!({ read: { density: "1 }; p 'Hacked'; {" }}) # => shows "Hacked"
```

### Patches
Upgrade to [2.1.1](https://rubygems.org/gems/carrierwave/versions/2.1.1) or [1.3.2](https://rubygems.org/gems/carrierwave/versions/1.3.2).

### Workarounds
Stop supplying untrusted input to `#manipulate!`'s mutation option.

### References
[Code Injection Software Attack](https://owasp.org/www-community/attacks/Code_Injection)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [CarrierWave repo](https://github.com/carrierwaveuploader/carrierwave)
* Email me at [mit.shibuya@gmail.com](mailto:mit.shibuya@gmail.com)
Vulnerability: GHSA-cxf7-qrc5-9446
Summary: Remote shell execution vulnerability in image_processing
Aliases: CVE-2022-24720
Severity: CRITICAL
CWE: CWE-20, CWE-78
Published: 2022-03-01T22:22:26Z

### Impact

When using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

```rb
ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED
```

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

### Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

### Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

```rb
operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)
```
Vulnerability: GHSA-cqxw-3p7v-p9gr
Summary: Phusion Passenger uses a known /tmp filename
Aliases: CVE-2016-10345
Severity: HIGH
Published: 2018-08-21T17:08:03Z

In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user
Vulnerability: GHSA-3892-2r52-p65m
Summary: HTTP Request Smuggling in goliath
Aliases: CVE-2020-7671
Severity: MODERATE
CWE: CWE-444
Published: 2021-05-24T18:20:07Z

goliath through 1.0.6 allows request smuggling attacks where goliath is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks.
Vulnerability: GHSA-jxx8-v83v-rhw3
Summary: Moderate severity vulnerability that affects spree
Aliases: CVE-2013-1656
Severity: MODERATE
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/payment_methods_controller.rb; and the (2) promotion_action parameter to promotion_actions_controller.rb, (3) promotion_rule parameter to promotion_rules_controller.rb, and (4) calculator_type parameter to promotions_controller.rb in promo/app/controllers/spree/admin/, related to unsafe use of the constantize function.
Vulnerability: GHSA-3m6r-39p3-jq25
Summary: Doorkeeper is vulnerable to replay attacks
Aliases: CVE-2016-6582
Severity: CRITICAL
CWE: CWE-1254
Published: 2017-10-24T18:33:35Z

The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
Vulnerability: GHSA-r74q-gxcg-73hx
Summary: High severity vulnerability that affects simple_form
Aliases: CVE-2019-16676
Severity: CRITICAL
CWE: CWE-20
Published: 2019-09-30T19:41:15Z

## Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

### Impact
For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

```erb
<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>
```

The string provided in the variable `@user_supplied_string` would be invoked as a method call inside the `@user` object (unless the string contains any of the following: `password`, `time_zone`, `country`, `email`, `phone` and `url`).

By manipulation that input, an attacker could do any of the following:

- Code execution (call actions like `#destroy`)
- Denial of Service (by executing a computation intensive method)
- Information Disclosure (check the presence of methods, leak user information)

### Patches
The problem was fixed in version `5.0`. Although it's a major version, there should be no issues with upgrading for `4.x`. The reason it was released in a major version is that the configuration `SimpleForm.file_methods` was deprecated in order to fix the problem.

### Workarounds
The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected.
A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the `as` option, like the following:
```erb
<%= form.input :avatar, as: :file %>
```

### References
[TDB]

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [https://github.com/plataformatec/simple_form](https://github.com/plataformatec/simple_form)
* Email us at [opensource@plataformatec.com.br](mailto:opensource@plataformatec.com.br)
Vulnerability: GHSA-x24j-87x9-jvv5
Summary: Improper Authorization in Publify
Aliases: CVE-2021-25973
Severity: MODERATE
CWE: CWE-285, CWE-863
Published: 2021-11-03T17:34:22Z

In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. “guest” role users can self-register even when the admin does not allow. This happens due to front-end restriction only.
Vulnerability: GHSA-3v3c-r5v2-68ph
Summary: High severity vulnerability that affects private_address_check
Aliases: CVE-2017-0909
Severity: HIGH
CWE: CWE-184
Published: 2017-11-30T23:14:55Z

The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.
Vulnerability: GHSA-r7q2-5gqg-6c7q
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2011-2929
Severity: MODERATE
CWE: CWE-20
Published: 2017-10-24T18:33:38Z

The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a crafted URL, related to a "filter skipping vulnerability."
Vulnerability: GHSA-ghqm-pgxj-37gq
Summary: Moderate severity vulnerability that affects rails-html-sanitizer
Aliases: CVE-2015-7580
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.
Vulnerability: GHSA-g4g4-3pqw-8m7f
Summary: Use After Free in rusqlite
Aliases: CVE-2021-45718
Severity: HIGH
CWE: CWE-416
Published: 2022-01-06T22:02:01Z

An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. rollback_hook has a use-after-free.
Vulnerability: GHSA-5rrv-m36h-qwf8
Summary: Use-after-free in chttp
Aliases: CVE-2019-16140
Severity: CRITICAL
CWE: CWE-416
Published: 2021-08-25T20:44:40Z

An issue was discovered in the chttp crate before 0.1.3 for Rust. There is a use-after-free during buffer conversion.
Vulnerability: RUSTSEC-2021-0121
Summary: Non-aligned u32 read in Chacha20 encryption and decryption
Published: 2021-10-08T12:00:00Z

The implementation does not enforce alignment requirements on input slices while incorrectly assuming 4-byte alignment through an unsafe call to `std::slice::from_raw_parts_mut`, which breaks the contract and introduces undefined behavior.

This affects Chacha20 encryption and decryption in crypto2.
Vulnerability: RUSTSEC-2021-0064
Summary: `cpuid-bool` has been renamed to `cpufeatures`
Published: 2021-05-06T12:00:00Z

Please use the `cpufeatures`` crate going forward:

<https://github.com/RustCrypto/utils/tree/master/cpufeatures>

There will be no further releases of `cpuid-bool`.
Vulnerability: GHSA-xm9m-2vj8-fmfr
Summary: Uninitialized memory access in toodee
Aliases: CVE-2021-28029
Severity: HIGH
CWE: CWE-908
Published: 2021-09-01T18:30:40Z

An issue was discovered in the toodee crate before 0.3.0 for Rust. The row-insertion feature allows attackers to read the contents of uninitialized memory locations.
Vulnerability: RUSTSEC-2018-0019
Summary: Multiple memory safety issues
Published: 2018-06-08T12:00:00Z

Affected versions contain multiple memory safety issues, such as:

 - Unsoundly coercing immutable references to mutable references
 - Unsoundly extending lifetimes of strings
 - Adding the `Send` marker trait to objects that cannot be safely sent between threads

This may result in a variety of memory corruption scenarios, most likely use-after-free.
 
A significant refactoring effort has been conducted to resolve these issues.
Vulnerability: RUSTSEC-2020-0078
Summary: `net2` invalidly assumes the memory layout of std::net::SocketAddr
Aliases: CVE-2020-35919
Published: 2020-11-07T12:00:00Z

The [`net2`](https://crates.io/crates/net2) crate has assumed `std::net::SocketAddrV4`
and `std::net::SocketAddrV6` have the same memory layout as the system C representation
`sockaddr`. It has simply casted the pointers to convert the socket addresses to the
system representation. The standard library does not say anything about the memory
layout, and this will cause invalid memory access if the standard library
changes the implementation. No warnings or errors will be emitted once the
change happens.
Vulnerability: RUSTSEC-2019-0005
Summary: Format string vulnerabilities in `pancurses`
Aliases: CVE-2019-15546
Published: 2019-06-15T12:00:00Z

`pancurses::mvprintw` and `pancurses::printw` passes a pointer from a rust `&str` to C,
allowing hostile input to execute a format string attack, which trivially allows writing
arbitrary data to stack memory.
Vulnerability: GHSA-45p7-c959-rgcm
Summary: Process crashes when the cell used as DepGroup is not alive
Severity: CRITICAL
Published: 2021-08-25T21:01:18Z

### Impact

It's easy to create a malign transaction which uses the dead cell as the DepGroup in the DepCells. The transaction can crash all the receiving nodes.
Vulnerability: GHSA-ppqp-78xx-3r38
Summary: Out of bounds write in calamine
Aliases: CVE-2021-26951
Severity: CRITICAL
CWE: CWE-787
Published: 2021-08-25T20:53:25Z

An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::set_len is used without proper memory claiming, and this uninitialized memory is used for a user-provided Read operation, as demonstrated by Sectors::get.
Vulnerability: RUSTSEC-2020-0097
Summary: Soundness issue with base::Error
Aliases: CVE-2020-36205
Published: 2020-12-10T12:00:00Z

`base::Error` type contains public field named `ptr`.
With this definition, it is possible to create a `base::Error` with an invalid pointer and trigger memory safety errors
such as use-after-free or double-free with safe Rust.

The users of `xcb` crate are advised not to manipulate the field.
Vulnerability: GHSA-qpjr-ch72-2qq4
Summary: Use after free in portaudio-rs
Aliases: CVE-2019-16881
Severity: CRITICAL
CWE: CWE-416
Published: 2021-08-25T20:45:17Z

An issue was discovered in the portaudio-rs crate through 0.3.1 for Rust. There is a use-after-free with resultant arbitrary code execution because of a lack of unwind safety in stream_callback and stream_finished_callback.
Vulnerability: GHSA-jqqr-c2r2-9cvr
Summary: Improper Certificate Validation in security-framework
Aliases: CVE-2017-18588
Severity: MODERATE
CWE: CWE-295
Published: 2021-08-25T20:42:59Z

An issue was discovered in the security-framework crate before 0.1.12 for Rust. Hostname verification for certificates does not occur if ClientBuilder uses custom root certificates.
Vulnerability: GHSA-32v7-ghpr-c8hg
Summary: Mishandling of format strings in ncurses
Aliases: CVE-2019-15547
Severity: HIGH
CWE: CWE-134
Published: 2021-08-25T20:58:47Z

An issue was discovered in the ncurses crate for Rust. There are format string issues in printw functions because C format arguments are mishandled.
Vulnerability: GHSA-h7qh-3h6f-w79p
Summary: Unexpected panic in multihash
Aliases: CVE-2020-35909
Severity: HIGH
CWE: CWE-20
Published: 2021-08-25T20:49:41Z

An issue was discovered in the multihash crate before 0.11.3 for Rust. The from_slice parsing code can panic via unsanitized data from a network server.
Vulnerability: RUSTSEC-2021-0033
Summary: push_cloned can drop uninitialized memory or double free on panic
Aliases: CVE-2021-28034, CVE-2021-28035
Published: 2021-02-22T12:00:00Z

Affected versions of `stack_dst` used a `push_inner` function that increased
the internal length of the array and then called `val.clone()`.

If the `val.clone()` call panics, the stack could drop an already dropped
element or drop uninitialized memory.

This issue was fixed in `2a4d538` by increasing the length of the array after
elements are cloned.
Vulnerability: RUSTSEC-2019-0013
Summary: Wrong memory orderings in RwLock potentially violates mutual exclusion
Aliases: CVE-2019-16137
Published: 2019-08-27T12:00:00Z

Wrong memory orderings inside the RwLock implementation allow for two writers to acquire the lock at the same time. The drop implementation used Ordering::Relaxed, which allows the compiler or CPU to reorder a mutable access on the locked data after the lock has been yielded.

Only users of the RwLock implementation are affected. Users of Once (including users of lazy_static with the `spin_no_std` feature enabled) are NOT affected.

On strongly ordered CPU architectures like x86, the only real way that this would lead to a memory corruption is if the compiler reorders an access after the lock is yielded, which is possible but in practice unlikely. It is a more serious issue on weakly ordered architectures such as ARM which, except in the presence of certain instructions, allow the hardware to decide which accesses are seen at what times. Therefore on an ARM system it is likely that using the wrong memory ordering would result in a memory corruption, even if the compiler itself doesn't reorder the memory accesses in a buggy way.

The flaw was corrected by https://github.com/mvdnes/spin-rs/pull/66.
Vulnerability: GHSA-2f5j-3mhq-xv58
Summary: Double free in sys-info 
Aliases: CVE-2020-36434
Severity: CRITICAL
CWE: CWE-415
Published: 2021-08-25T20:58:15Z

An issue was discovered in the sys-info crate before 0.8.0 for Rust. sys_info::disk_info calls can trigger a double free.
Vulnerability: RUSTSEC-2020-0081
Summary: `mio` invalidly assumes the memory layout of std::net::SocketAddr
Aliases: CVE-2020-35922
Published: 2020-11-02T12:00:00Z

The [`mio`](https://crates.io/crates/mio) crate has assumed `std::net::SocketAddrV4`
and `std::net::SocketAddrV6` have the same memory layout as the system C representation
`sockaddr`. It has simply casted the pointers to convert the socket addresses to the
system representation. The standard library does not say anything about the memory
layout, and this will cause invalid memory access if the standard library
changes the implementation. No warnings or errors will be emitted once the
change happens.
Vulnerability: GHSA-p46c-w9m3-7qr2
Summary: Use of Uninitialized Resource in flumedb.
Aliases: CVE-2021-45684
Severity: CRITICAL
CWE: CWE-908
Published: 2022-01-06T22:18:35Z

An issue was discovered in the flumedb crate through 2021-01-07 for Rust. read_entry may read from uninitialized memory locations.
Vulnerability: GHSA-hqc8-j86x-2764
Summary: Off-by-one error in simple-slab
Aliases: CVE-2020-35893
Severity: HIGH
CWE: CWE-193
Published: 2021-08-25T20:48:33Z

An issue was discovered in the simple-slab crate before 0.3.3 for Rust. remove() has an off-by-one error, causing memory leakage and a drop of uninitialized memory.
Vulnerability: RUSTSEC-2016-0001
Summary: SSL/TLS MitM vulnerability due to insecure defaults
Aliases: CVE-2016-10931
Published: 2016-11-05T12:00:00Z

All versions of rust-openssl prior to 0.9.0 contained numerous insecure defaults
including off-by-default certificate verification and no API to perform hostname
verification.

Unless configured correctly by a developer, these defaults could allow an attacker
to perform man-in-the-middle attacks.

The problem was addressed in newer versions by enabling certificate verification
by default and exposing APIs to perform hostname verification. Use the
`SslConnector` and `SslAcceptor` types to take advantage of these new features
(as opposed to the lower-level `SslContext` type).
Vulnerability: RUSTSEC-2021-0025
Summary: crate has been renamed to `qjsonrpc`
Published: 2021-02-15T12:00:00Z

This crate has been renamed from `jsonrpc-quic` to `qjsonrpc`.

The new repository location is:

<https://github.com/maidsafe/sn_api>
Vulnerability: GHSA-62jx-8vmh-4mcw
Summary: Path trav in tar
Aliases: CVE-2021-38511
Severity: HIGH
CWE: CWE-22
Published: 2021-08-25T20:58:23Z

An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal.
Vulnerability: RUSTSEC-2020-0039
Summary: `index()` allows out-of-bound read and `remove()` has off-by-one error
Aliases: CVE-2020-35892, CVE-2020-35893
Published: 2020-09-03T12:00:00Z

`Slab::index()` does not perform the boundary checking, which leads to out-of-bound read access. `Slab::remove()` copies an element from an invalid address due to off-by-one error, resulting in memory leakage and uninitialized memory drop.
Vulnerability: GHSA-f3mq-99jr-ww4r
Summary: Multiple mutable pointers in cgc
Aliases: CVE-2020-36467
Severity: MODERATE
CWE: CWE-657
Published: 2021-08-25T20:56:16Z

Affected versions of this crate have the following issues:

1. `Ptr` implements `Send` and `Sync` for all types, this can lead to data
   races by sending non-thread safe types across threads.

2. `Ptr::get` violates mutable alias rules by returning multiple mutable
   references to the same object.

3. `Ptr::write` uses non-atomic writes to the underlying pointer. This means
   that when used across threads it can lead to data races.
Vulnerability: GHSA-qgm6-9472-pwq7
Summary: Integer Overflow in openssl-src
Aliases: CVE-2021-23840
Severity: HIGH
CWE: CWE-190
Published: 2021-08-25T20:52:19Z

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).
Vulnerability: GHSA-69fv-gw6g-8ccg
Summary: Potential memory corruption in arrayfire
Aliases: CVE-2018-20998
Severity: CRITICAL
CWE: CWE-119
Published: 2021-08-25T20:43:26Z

An issue was discovered in the arrayfire crate before 3.6.0 for Rust. Addition of the repr() attribute to an enum is mishandled, leading to memory corruption.
Vulnerability: GHSA-pfjq-935c-4895
Summary: Data races in v9
Severity: MODERATE
CWE: CWE-362
Published: 2021-08-25T21:00:37Z

Affected versions of this crate unconditionally implement `Sync` for `SyncRef<T>`.
This definition allows data races if `&T` is accessible through `&SyncRef`.

`SyncRef<T>` derives `Clone` and `Debug`, and the default implementations of those traits access `&T` by invoking `T::clone()` & `T::fmt()`. It is possible to create data races & undefined behavior by concurrently invoking `SyncRef<T>::clone()` or `SyncRef<T>::fmt()` from multiple threads with `T: !Sync`.
Vulnerability: RUSTSEC-2021-0072
Summary: Task dropped in wrong thread when aborting `LocalSet` task
Aliases: CVE-2021-38191
Published: 2021-07-07T12:00:00Z

When aborting a task with `JoinHandle::abort`, the future is dropped in the
thread calling abort if the task is not currently being executed. This is
incorrect for tasks spawned on a `LocalSet`.

This can easily result in race conditions as many projects use `Rc` or `RefCell`
in their Tokio tasks for better performance.

See [tokio#3929][issue] for more details.

[issue]: https://github.com/tokio-rs/tokio/issues/3929
Vulnerability: GHSA-qc36-q22q-cjw3
Summary: SMTP command injection in lettre
Aliases: CVE-2021-38189
Severity: CRITICAL
CWE: CWE-147
Published: 2021-07-12T17:03:27Z

### Impact

Affected versions of lettre allowed SMTP command injection through an attacker's controlled message body. The module for escaping lines starting with a period wouldn't catch a period that was placed after a double CRLF sequence, allowing the attacker to end the current message and write arbitrary SMTP commands after it.

### Fix

The flaw is fixed by correctly handling consecutive CRLF sequences.

### References

* [RUSTSEC-2021-0069](https://rustsec.org/advisories/RUSTSEC-2021-0069.html)
Vulnerability: RUSTSEC-2020-0107
Summary: hashconsing's HConsed lacks Send/Sync bound for its Send/Sync trait.
Aliases: CVE-2020-36215
Published: 2020-11-10T12:00:00Z

Affected versions of `hashconsing` implements `Send`/`Sync` for its `HConsed` type without restricting it to `Send`able types and `Sync`able types.

This allows non-`Sync` types such as `Cell` to be shared across threads leading to undefined behavior and memory corruption in concurrent programs.
Vulnerability: GHSA-3h87-v52r-p9rg
Summary: Out of bounds write in reorder
Aliases: CVE-2021-29941
Severity: HIGH
CWE: CWE-787
Published: 2021-08-25T20:54:08Z

An issue was discovered in the reorder crate through 2021-02-24 for Rust. swap_index has an out-of-bounds write if an iterator returns a len() that is too small.
Vulnerability: GHSA-4vhw-4rw7-jfpv
Summary: Path traversal in mozwire
Aliases: CVE-2020-35883
Severity: CRITICAL
CWE: CWE-22
Published: 2021-08-25T20:49:02Z

An issue was discovered in the mozwire crate through 2020-08-18 for Rust. A ../ directory-traversal situation allows overwriting local files that have .conf at the end of the filename.
Vulnerability: RUSTSEC-2020-0042
Summary: Missing check in ArrayVec leads to out-of-bounds write.
Aliases: CVE-2020-35895
Published: 2020-09-24T12:00:00Z

ArrayVec::insert allows insertion of an element into the array object into the
specified index. Due to a missing check on the upperbound of this index, it is
possible to write out of bounds.
Vulnerability: RUSTSEC-2021-0009
Summary: panic safety issue in `impl TransformContent<S, D> for [S; (2|3|4)]`
Aliases: CVE-2021-25906
Published: 2021-01-10T12:00:00Z

Affected versions of this crate did not guard against double drop while temporarily duplicating objects' ownership using `ptr::read()`. Upon panic in a user-provided function `conversion`, objects that are copied by `ptr::read()` are dropped twice, leading to memory corruption.

The flaw was corrected in v0.9.2 by using `ManuallyDrop<T>` to enclose objects that are to be temporarily duplicated.
Vulnerability: GHSA-mxv6-q98x-h958
Summary: Data races in model
Aliases: CVE-2020-36460
Severity: HIGH
CWE: CWE-843, CWE-362
Published: 2021-08-25T20:56:07Z

`Shared` data structure in `model` crate implements `Send` and `Sync` traits regardless of the inner type.
This allows safe Rust code to trigger a data race, which is undefined behavior in Rust.

Users are advised to treat `Shared` as an unsafe type.
It should not be used outside of the testing context,
and care must be taken so that the testing code does not have a data race
besides a race condition that is expected to be caught by the test.
Vulnerability: RUSTSEC-2020-0150
Summary: RingBuffer can create multiple mutable references and cause data races
Aliases: CVE-2020-36470
Published: 2020-12-17T12:00:00Z

The `RingBuffer` type retrieves mutable references from the `DataProvider` in a
non-atomic manner, potentially allowing the creation of multiple mutable
references. `RingBuffer` also implements the `Send` and `Sync` traits for all
types `T`.

This allows undefined behavior from the aliased mutable references as well
as data races.
Vulnerability: GHSA-rfgg-vccr-m46m
Summary: Missing release of memory in sized-chunks
Aliases: CVE-2020-25794
Severity: HIGH
CWE: CWE-401
Published: 2021-08-25T20:45:58Z

An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, clone can have a memory-safety issue upon a panic.
Vulnerability: RUSTSEC-2020-0015
Summary: Crash causing Denial of Service attack
Aliases: CVE-2020-1967
Published: 2020-04-25T12:00:00Z

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 
handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the 
"signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature 
algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of 
Service attack.
Vulnerability: RUSTSEC-2020-0146
Summary: arr! macro erases lifetimes
Aliases: CVE-2020-36465
Published: 2020-04-09T12:00:00Z

Affected versions of this crate allowed unsoundly extending
lifetimes using `arr!` macro. This may result in a variety of
memory corruption scenarios, most likely use-after-free.
Vulnerability: RUSTSEC-2020-0003
Summary: rust_sodium is unmaintained; switch to a modern alternative
Published: 2020-01-20T12:00:00Z

The `rust_sodium` crate is no longer maintained by its current owner, who
advise in the repository readme that they are looking for
someone else to take ownership of it.

We recommend you switch to an alternative crate such as:
- [`sodiumoxide`](https://crates.io/crates/sodiumoxide)
Vulnerability: RUSTSEC-2021-0048
Summary: StackVec::extend can write out of bounds when size_hint is incorrect
Aliases: CVE-2021-29939
Published: 2021-02-19T12:00:00Z

`StackVec::extend` used the lower and upper bounds from an Iterator's
`size_hint` to determine how many items to push into the stack based vector.

If the `size_hint` implementation returned a lower bound that was larger than
the upper bound, `StackVec` would write out of bounds and overwrite memory
on the stack. As mentioned by the [size_hint](https://doc.rust-lang.org/std/iter/trait.Iterator.html#provided-methods)
documentation, `size_hint` is mainly for optimization and incorrect
implementations should not lead to memory safety issues.
Vulnerability: GHSA-c3cw-c387-pj65
Summary: Double free in crossbeam
Aliases: CVE-2018-20996
Severity: CRITICAL
CWE: CWE-415
Published: 2021-08-25T20:43:21Z

An issue was discovered in the crossbeam crate before 0.4.1 for Rust. There is a double free because of destructor mishandling.
Vulnerability: GHSA-r626-fc64-3q28
Summary: Data race in abox
Aliases: CVE-2020-36441
Severity: HIGH
CWE: CWE-119, CWE-362
Published: 2021-08-25T20:59:06Z

An issue was discovered in the abox crate before 0.4.1 for Rust. 

Affected versions of this crate implements `Send`/`Sync` for `AtomicBox<T>` without requiring `T: Send`/`T: Sync`. This allows to create data races to `T: !Sync` and send `T: !Send` to another thread.

Such behavior breaks the compile-time thread safety guarantees of Rust, and allows users to incur undefined behavior using safe Rust (e.g. memory corruption from data race).

The flaw was corrected in commit 34c2b9e by adding trait bound `T: Send` to `Send` impl for `AtomicBox<T>` and trait bound `T: Sync` to `Sync` impl for `AtomicBox<T>`.
Vulnerability: GHSA-34p9-f4q3-c4r7
Summary: Improper Certificate Validation in openssl
Aliases: CVE-2016-10931
Severity: HIGH
CWE: CWE-295
Published: 2021-08-25T20:43:11Z

An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.
Vulnerability: GHSA-pqqp-xmhj-wgcw
Summary: Data race in crossbeam-deque
Aliases: CVE-2021-32810
Severity: CRITICAL
CWE: CWE-362
Published: 2021-08-25T21:01:15Z

### Impact

In the affected version of this crate, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a logical bug.

Crates using `Stealer::steal`, `Stealer::steal_batch`, or `Stealer::steal_batch_and_pop` are affected by this issue.

### Patches

This has been fixed in crossbeam-deque 0.8.1 and 0.7.4.

### Credits

This issue was reported and fixed by Maor Kleinberger.
Vulnerability: RUSTSEC-2020-0111
Summary: may_queue's Queue lacks Send/Sync bound for its Send/Sync trait.
Aliases: CVE-2020-36217
Published: 2020-11-10T12:00:00Z

Affected versions of `may_queue` implements `Send`/`Sync` for its `Queue` type without restricting it to `Send`able types and `Sync`able types.

This allows non-`Sync` types such as `Cell` to be shared across threads leading to undefined behavior and memory corruption in concurrent programs.
Vulnerability: GHSA-4873-36h9-wv49
Summary: Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime 
Aliases: CVE-2021-39218
Severity: MODERATE
CWE: CWE-590, CWE-125, CWE-787
Published: 2021-09-20T19:54:16Z

### Impact

There was an invalid free and out-of-bounds read and write bug when running Wasm that uses `externref`s in Wasmtime.

To trigger this bug, Wasmtime needs to be running Wasm that uses `externref`s, the host creates non-null `externrefs`, Wasmtime performs a garbage collection (GC), and there has to be a Wasm frame on the stack that is at a GC safepoint where

* there are no live references at this safepoint, and
* there is a safepoint with live references earlier in this frame's function.

Under this scenario, Wasmtime would incorrectly use the GC stack map for the safepoint from earlier in the function instead of the empty safepoint. This would result in Wasmtime treating arbitrary stack slots as `externref`s that needed to be rooted for GC. At the *next* GC, it would be determined that nothing was referencing these bogus `externref`s (because nothing could ever reference them, because they are not really `externref`s) and then Wasmtime would deallocate them and run `<ExternRef as Drop>::drop` on them. This results in a free of memory that is not necessarily on the heap (and shouldn't be freed at this moment even if it was), as well as potential out-of-bounds reads and writes.

Even though support for `externref`s (via the reference types proposal) is enabled by default, unless you are creating non-null `externref`s in your host code or explicitly triggering GCs, you cannot be affected by this bug.

We have reason to believe that the effective impact of this bug is relatively small because usage of `externref` is currently quite rare.

### Patches

This bug has been patched and users should upgrade to Wasmtime version 0.30.0.

Additionally, we have updated [our primary `externref` fuzz target](https://github.com/bytecodealliance/wasmtime/blob/37c094faf53f1b356aab3c79d451395e4f7edb34/fuzz/fuzz_targets/table_ops.rs) such that it better exercises these code paths and we can have greater confidence in their correctness going forward.

### Workarounds

If you cannot upgrade Wasmtime at this time, you can avoid this bug by disabling the reference types proposal by passing `false` to [`wasmtime::Config::wasm_reference_types`](https://docs.rs/wasmtime/0.29.0/wasmtime/struct.Config.html#method.wasm_reference_types)

### References

* [The Wasm reference types proposal, which introduces `externref`](https://github.com/WebAssembly/reference-types/)

### For more information

If you have any questions or comments about this advisory:

* Reach out to us on [the Bytecode Alliance Zulip chat](https://bytecodealliance.zulipchat.com/#narrow/stream/217126-wasmtime)
* Open an issue in [the `bytecodealliance/wasmtime` repository](https://github.com/bytecodealliance/wasmtime/)
Vulnerability: RUSTSEC-2019-0029
Summary: ChaCha20 counter overflow can expose repetitions in the keystream
Aliases: CVE-2019-25005
Published: 2019-10-22T12:00:00Z

The ChaCha20 stream cipher can produce a maximum of 2^32 blocks (~256GB)
before the 32-bit counter overflows. Releases of the `chacha20` crate prior
to v0.2.3 allow generating keystreams larger than this, including seeking
past the limit. When this occurs, the keystream is duplicated, with failure
modes similar to nonce reuse (i.e. exposure of the XOR of two plaintexts).

The v0.2.3 release now panics in this event, rather than exposing the
duplicated keystream. Note this is a "hot fix" solution to the problem
and future releases will pursue returning an error in this case.

Users of the `chacha20poly1305` crate are unaffected by this as this crate
properly asserts the length of the plaintext is less than the maximum allowed
(`P_MAX` as described in RFC 8439 Section 2.8).
Vulnerability: GHSA-rm4w-6696-r77p
Summary: nb-connect invalidly assumes the memory layout of std::net::SocketAddr
Aliases: CVE-2021-27376
Severity: CRITICAL
CWE: CWE-119
Published: 2021-08-25T20:52:14Z

An issue was discovered in the nb-connect crate before 1.0.3 for Rust. It may have invalid memory access for certain versions of the standard library because it relies on a direct cast of std::net::SocketAddrV4 and std::net::SocketAddrV6 data structures.
Vulnerability: GHSA-8q2v-67v7-6vc6
Summary: Data races in rocket
Aliases: CVE-2020-35882
Severity: HIGH
CWE: CWE-362
Published: 2021-08-25T20:48:07Z

An issue was discovered in the rocket crate before 0.4.5 for Rust. LocalRequest::clone creates more than one mutable references to the same object, possibly causing a data race.
Vulnerability: GHSA-9783-42pm-x5jq
Summary: Use of Uninitialized Resource in csv-sniffer.
Aliases: CVE-2021-45686
Severity: CRITICAL
CWE: CWE-908
Published: 2022-01-06T22:13:58Z

An issue was discovered in the csv-sniffer crate through 2021-01-05 for Rust. preamble_skipcount may read from uninitialized memory locations.
Vulnerability: GHSA-x3v2-fgr6-3wmm
Summary: Double free in fil-ocl
Aliases: CVE-2021-25908
Severity: HIGH
CWE: CWE-415
Published: 2021-08-25T20:53:03Z

An issue was discovered in the fil-ocl crate through 2021-01-04 for Rust. From<EventList> can lead to a double free.
Vulnerability: GHSA-m57c-4vvx-gjgq
Summary: Format string vulnerabilities in pancurses
Aliases: CVE-2019-15546
Severity: HIGH
CWE: CWE-134
Published: 2021-08-25T20:58:27Z

An issue was discovered in the pancurses crate through 0.16.1 for Rust. printw and mvprintw have format string vulnerabilities.
Vulnerability: RUSTSEC-2021-0087
Summary: columnar: `Read` on uninitialized buffer may cause UB (ColumnarReadExt::read_typed_vec())
Published: 2021-01-07T12:00:00Z

Affected versions of this crate passes an uninitialized buffer to a user-provided `Read` implementation (`ColumnarReadExt::read_typed_vec()`).

Arbitrary `Read` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer.
Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.
Vulnerability: RUSTSEC-2018-0015
Summary: term is looking for a new maintainer
Published: 2018-11-19T12:00:00Z

The author of the `term` crate does not have time to maintain it and is looking
for a new maintainer.

Some maintained alternatives you can potentially switch to instead, depending
on your needs:

- [`crossterm`](https://github.com/crossterm-rs/crossterm)
- [`termcolor`](https://crates.io/crates/termcolor)
- [`yansi`](https://crates.io/crates/yansi)
Vulnerability: RUSTSEC-2021-0068
Summary: Soundness issue in `iced-x86` versions <= 1.10.3
Aliases: CVE-2021-38188
Published: 2021-05-19T12:00:00Z

Versions of iced-x86 <= 1.10.3 invoke undefined behavior which may cause soundness
issues in crates using the `iced_x86::Decoder` struct. The `Decoder::new()` function
made a call to `slice.get_unchecked(slice.length())` to get the end position of 
the input buffer. The flaw was fixed with safe logic that does not invoke undefined
behavior.

More details can be found at <https://github.com/icedland/iced/issues/168>.
Vulnerability: RUSTSEC-2020-0023
Summary: Lifetime boundary for `raw_slice` and `raw_slice_mut` are incorrect
Aliases: CVE-2020-35879
Published: 2020-02-11T12:00:00Z

The affected version of `rulinalg` has incorrect lifetime boundary definitions
for `RowMut::raw_slice` and `RowMut::raw_slice_mut`. They do not conform with
Rust's borrowing rule and allows the user to create multiple mutable references
to the same location. This may result in unexpected calculation result and data
race if both references are used at the same time.
Vulnerability: RUSTSEC-2017-0007
Summary: lz4-compress is unmaintained
Published: 2017-04-17T12:00:00Z

[According to the developers](https://gitlab.redox-os.org/redox-os/tfs/issues/89) this crate is no longer maintained.

The suggested alternative is [`lz4-compression`](https://crates.io/crates/lz4-compression), a maintained fork of `lz4-compress`.

See also [lz-fear](https://crates.io/crates/lz-fear) which is compatible with the reference LZ4 implementation in C, but not with lz4-compress.
Vulnerability: GHSA-7qcc-g2m9-8533
Summary: Null pointer deference in fltk
Aliases: CVE-2021-28307
Severity: HIGH
CWE: CWE-476
Published: 2021-08-25T20:53:53Z

An issue was discovered in the fltk crate before 0.15.3 for Rust. There is a NULL pointer dereference during attempted use of a non-raster image for a window icon.
Vulnerability: GHSA-76w9-p8mg-j927
Summary: Out-of-bounds Write in nix
Aliases: CVE-2021-45707
Severity: CRITICAL
CWE: CWE-787
Published: 2022-01-06T22:07:14Z

An issue was discovered in the nix crate before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2 for Rust. unistd::getgrouplist has an out-of-bounds write if a user is in more than 16 /etc/groups groups.
Vulnerability: RUSTSEC-2019-0009
Summary: Double-free and use-after-free in SmallVec::grow()
Aliases: CVE-2019-15551
Published: 2019-06-06T12:00:00Z

Attempting to call `grow` on a spilled SmallVec with a value equal to the current capacity causes it to free the existing data. This performs a double free immediately and may lead to use-after-free on subsequent accesses to the SmallVec contents.

An attacker that controls the value passed to `grow` may exploit this flaw to obtain memory contents or gain remote code execution.

Credits to @ehuss for discovering, reporting and fixing the bug.
Vulnerability: RUSTSEC-2020-0074
Summary: Reference counting error in `From<Py<T>>`
Aliases: CVE-2020-35917
Published: 2020-11-28T12:00:00Z

A bug in `From<Py<T>>` would lead to an extra reference count decrement, often
leading to use-after-free issues.
Vulnerability: RUSTSEC-2020-0131
Summary: Send/Sync bound needed on T  for Send/Sync impl of RcuCell<T>
Aliases: CVE-2020-36451
Published: 2020-11-14T12:00:00Z

Affected versions of this crate unconditionally implement Send/Sync for `RcuCell<T>`.
This allows users to send `T: !Send` to other threads (while `T` enclosed within `RcuCell<T>`), and allows users to concurrently access `T: !Sync` by using the APIs of `RcuCell<T>` that provide access to `&T`.

This can result in memory corruption caused by data races.
Vulnerability: GHSA-rh89-x75f-rh3c
Summary: Exposure of uninitialized memory in memoffset
Aliases: CVE-2019-15553
Severity: HIGH
CWE: CWE-908
Published: 2021-08-25T20:44:00Z

An issue was discovered in the memoffset crate before 0.5.0 for Rust. offset_of and span_of can cause exposure of uninitialized memory.
Vulnerability: GHSA-2969-8hh9-57jc
Summary: Allocation of Resources Without Limits or Throttling in ckb
Aliases: CVE-2021-45699
Severity: HIGH
CWE: CWE-770
Published: 2022-01-06T22:09:49Z

An issue was discovered in the ckb crate before 0.40.0 for Rust. Remote attackers may be able to conduct a 51% attack against the Nervos CKB blockchain by triggering an inability to allocate memory for the misbehavior HashMap.
Vulnerability: RUSTSEC-2021-0029
Summary: Tape::take_bytes exposes uninitialized memory to a user-provided Read
Aliases: CVE-2021-28030
Published: 2021-02-17T12:00:00Z

Affected versions of this crate passed an unininitialized buffer to a
user-provided `Read` instance in `Tape::take_bytes`.

This can result in safe `Read` implementations reading from the uninitialized
buffer leading to undefined behavior.

The flaw was corrected in commit `1f2dc7f37dd` by removing the unsafe block
and zero-initializing the buffer.
Vulnerability: RUSTSEC-2020-0062
Summary: Improper `Sync` implementation on `FuturesUnordered` in futures-utils can cause data corruption
Aliases: CVE-2020-35908
Published: 2020-01-24T12:00:00Z

Affected versions of the crate had an unsound `Sync` implementation on the `FuturesUnordered` structure, which used a `Cell` for
interior mutability without any code to handle synchronized access to the underlying task list's length and head safely.

This could of lead to data corruption since two threads modifying the list at once could see incorrect values due to the lack
of access synchronization.

The issue was fixed by adding access synchronization code around insertion of tasks into the list.
Vulnerability: GHSA-c3m3-c39q-pv23
Summary: Out of bounds write in slice-deque
Aliases: CVE-2019-15543
Severity: CRITICAL
CWE: CWE-787
Published: 2021-08-25T20:44:10Z

An issue was discovered in the slice-deque crate before 0.2.0 for Rust. There is memory corruption in certain allocation cases.
Vulnerability: GHSA-3jc5-5hc5-33gj
Summary: Data races in conquer-once
Aliases: CVE-2020-36208
Severity: HIGH
CWE: CWE-662, CWE-787
Published: 2021-08-25T20:50:49Z

An issue was discovered in the conquer-once crate before 0.3.2 for Rust. Thread crossing can occur for a non-Send but Sync type, leading to memory corruption.
Vulnerability: GHSA-wr55-mf5c-hhwm
Summary: Data races in late-static
Aliases: CVE-2020-36209
Severity: HIGH
CWE: CWE-662
Published: 2021-08-25T20:50:44Z

An issue was discovered in the late-static crate before 0.4.0 for Rust. Because Sync is implemented for LateStatic with T: Send, a data race can occur.
Vulnerability: RUSTSEC-2020-0127
Summary: SyncRef's clone() and debug() allow data races
Aliases: CVE-2020-36447
Published: 2020-12-18T12:00:00Z

Affected versions of this crate unconditionally implement `Sync` for `SyncRef<T>`.
This definition allows data races if `&T` is accessible through `&SyncRef`.

`SyncRef<T>` derives `Clone` and `Debug`, and the default implementations of those traits access `&T` by invoking `T::clone()` & `T::fmt()`. It is possible to create data races & undefined behavior by concurrently invoking `SyncRef<T>::clone()` or `SyncRef<T>::fmt()` from multiple threads with `T: !Sync`.
Vulnerability: RUSTSEC-2021-0091
Summary: Reading on uninitialized buffer may cause UB ( `gfx_auxil::read_spirv()` )
Published: 2021-01-07T12:00:00Z

Affected versions of this crate passes an uninitialized buffer to a user-provided `Read` implementation.

Arbitrary `Read` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer.
Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.