TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-gm68-g349-gxgg
Summary: Denial of service in bingrep
Aliases: CVE-2021-39480
Severity: MODERATE
CWE: CWE-770
Published: 2022-01-28T22:35:16Z

Bingrep v0.8.5 was discovered to contain a memory allocation failure which can cause a Denial of Service (DoS).
Vulnerability: GHSA-rxr4-x558-x7hw
Summary: Double free in smallvec
Aliases: CVE-2018-20991
Severity: CRITICAL
CWE: CWE-415
Published: 2021-08-25T20:42:54Z

An issue was discovered in the smallvec crate before 0.6.3 for Rust. The Iterator implementation mishandles destructors, leading to a double free.
Vulnerability: GHSA-39wr-f4ff-xm6p
Summary: Incorrect implementation in streebog
Aliases: CVE-2019-25007
Severity: HIGH
CWE: CWE-617
Published: 2021-08-25T20:46:41Z

An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can cause a panic.
Vulnerability: GHSA-vc2p-r46x-m3vx
Summary: Argument injection in lettre
Aliases: CVE-2020-28247
Severity: MODERATE
CWE: CWE-77
Published: 2021-08-25T20:56:48Z

### Impact

Affected versions of lettre allowed argument injection to the sendmail command. It was possible, using forged to addresses, to pass arbitrary arguments to the sendmail executable.

Depending on the implementation (original sendmail, postfix, exim, etc.) it could be possible in some cases to write email data into abritrary files (using sendmail's logging features).

*NOTE*: This vulnerability only affects the sendmail transport. Others, including smtp, are not affected.

### Fix

The flaw is corrected by modifying the executed command to stop parsing arguments before passing the destination addresses.

### References

* [RUSTSEC-2020-0069](https://rustsec.org/advisories/RUSTSEC-2020-0069.html)
* [CVE-2020-28247](https://nvd.nist.gov/vuln/detail/CVE-2020-28247)
Vulnerability: RUSTSEC-2018-0003
Summary: Possible double free during unwinding in SmallVec::insert_many
Aliases: CVE-2018-20991
Published: 2018-07-19T12:00:00Z

If an iterator passed to `SmallVec::insert_many` panicked in `Iterator::next`,
destructors were run during unwinding while the vector was in an inconsistent
state, possibly causing a double free (a destructor running on two copies of
the same value).

This is fixed in smallvec 0.6.3 by ensuring that the vector's length is not
updated to include moved items until they have been removed from their
original positions.  Items may now be leaked if `Iterator::next` panics, but
they will not be dropped more than once.

Thank you to @Vurich for reporting this bug.
Vulnerability: RUSTSEC-2020-0035
Summary: Chunk API does not respect align requirement
Aliases: CVE-2020-36433
Published: 2020-08-25T12:00:00Z

Chunk API does not respect the align requirement of types. Unaligned reference can be created with the API, which is an undefined behavior.
Vulnerability: GHSA-2vx6-fcw6-hpr6
Summary: Reference counting error in pyo3
Aliases: CVE-2020-35917
Severity: MODERATE
CWE: CWE-416
Published: 2021-08-25T20:49:52Z

An issue was discovered in the pyo3 crate before 0.12.4 for Rust. There is a reference-counting error and use-after-free in From<Py<T>>.
Vulnerability: RUSTSEC-2021-0005
Summary: Double drop upon panic in 'fn map_array()'
Aliases: CVE-2021-25902
Published: 2021-01-10T12:00:00Z

Affected versions of this crate did not guard against panic within the user-provided function `f` (2nd parameter of `fn map_array`), and thus panic within `f` 
causes double drop of a single object.

The flaw was corrected in the 0.4.0 release by wrapping the object vulnerable
to a double drop within `ManuallyDrop<T>`.
Vulnerability: GHSA-2wc6-2rcj-8v76
Summary: scalarmult() vulnerable to degenerate public keys
Aliases: CVE-2017-1000168
Severity: MODERATE
CWE: CWE-1240
Published: 2021-08-25T21:00:41Z

The `scalarmult()` function included in previous versions of this crate
accepted all-zero public keys, for which the resulting Diffie-Hellman shared
secret will always be zero regardless of the private key used.

This issue was fixed by checking for this class of keys and rejecting them
if they are used.
Vulnerability: RUSTSEC-2019-0033
Summary: Integer Overflow in HeaderMap::reserve() can cause Denial of Service
Aliases: CVE-2020-25574, CVE-2019-25008
Published: 2019-11-16T12:00:00Z

`HeaderMap::reserve()` used `usize::next_power_of_two()` to calculate the increased capacity.
However, `next_power_of_two()` silently overflows to 0 if given a sufficiently large number
in release mode.

If the map was not empty when the overflow happens,
the library will invoke `self.grow(0)` and start infinite probing.
This allows an attacker who controls the argument to `reserve()`
to cause a potential denial of service (DoS).

The flaw was corrected in 0.1.20 release of `http` crate.
Vulnerability: RUSTSEC-2021-0052
Summary: Multiple functions can cause double-frees
Aliases: CVE-2021-30457, CVE-2021-30456, CVE-2021-30455
Published: 2021-02-26T12:00:00Z

The following functions in the crate are affected:

## `IdMap::clone_from`

The `clone_from` implementation for `IdMap` drops the values present in the
map and then begins cloning values from the other map. If a `.clone()` call
pancics, then the afformentioned dropped elements can be freed again.

## `get_or_insert`

`get_or_insert` reserves space for a value, before calling the user provided
insertion function `f`. If the function `f` panics then uninitialized or
previously freed memory can be dropped.

## `remove_set`

When removing a set of elements, `ptr::drop_in_place` is called on each of the
element to be removed. If the `Drop` impl of one of these elements panics then
the previously dropped elements can be dropped again.
Vulnerability: RUSTSEC-2022-0007
Summary: A malicious coder can get unsound access to TCell or TLCell memory
Published: 2022-01-24T12:00:00Z

This is impossible to do by accident, but by carefully constructing
marker types to be covariant, a malicious coder can cheat the
singleton check in `TCellOwner` and `TLCellOwner`, giving unsound
access to cell memory.  This could take the form of getting two
mutable references to the same memory, or a mutable reference and an
immutable reference.

The fix is for the crate to internally force the marker type to be
invariant.  This blocks the conversion between covariant types which
Rust normally allows.
Vulnerability: RUSTSEC-2021-0117
Summary: `DecimalArray` does not perform bound checks on accessing values and offsets
Published: 2021-09-14T12:00:00Z

`DecimalArray` performs insufficient bounds checks,
which allows out-of-bounds reads in safe code
if the lenght of the backing buffer is not a multiple of 16.
Vulnerability: GHSA-q3cc-7p7g-392c
Summary: Use after free in rusqlite
Aliases: CVE-2020-35873
Severity: CRITICAL
CWE: CWE-416
Published: 2021-08-25T20:47:43Z

An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because sessions.rs has a use-after-free.
Vulnerability: RUSTSEC-2020-0019
Summary: tokio-rustls reads may cause excessive memory usage
Aliases: CVE-2020-35875
Published: 2020-05-19T12:00:00Z

`tokio-rustls` does not call `process_new_packets` immediately after `read`,
so the expected termination condition `wants_read` always returns true.
As long as new incoming data arrives faster than it is processed
and the reader does not return pending, data will be buffered.

This may cause DoS.
Vulnerability: GHSA-fhvc-gp6c-h2wx
Summary: Read on uninitialized buffer in postscript
Aliases: CVE-2021-26953
Severity: HIGH
CWE: CWE-908
Published: 2021-08-25T20:52:23Z

An issue was discovered in the postscript crate before 0.14.0 for Rust. It might allow attackers to obtain sensitive information from uninitialized memory locations via a user-provided Read implementation.
Vulnerability: GHSA-m296-j53x-xv95
Summary: Data races in tiny_future
Severity: MODERATE
CWE: CWE-362
Published: 2021-08-25T21:00:32Z

`tiny_future` contains a light-weight implementation of `Future`s. The `Future`
type it has lacked bound on its `Send` and `Sync` traits.

This allows for a bug where non-thread safe types such as `Cell` can be used in
`Future`s and cause data races in concurrent programs.

The flaw was corrected in commit `c791919` by adding trait bounds to `Future`'s
`Send` and `Sync`.
Vulnerability: RUSTSEC-2021-0044
Summary: Use after free possible in `uri::Formatter` on panic
Aliases: CVE-2021-29935
Published: 2021-02-09T12:00:00Z

Affected versions of this crate transmuted a `&str` to a `&'static str` before
pushing it into a `StackVec`, this value was then popped later in the same
function.

This was assumed to be safe because the reference would be valid while the
method's stack was active. In between the push and the pop, however, a function
`f` was called that could invoke a user provided function.

If the user provided panicked, then the assumption used by the function was no
longer true and the transmute to `&'static` would create an illegal static
reference to the string. This could result in a freed string being used during
(such as in a `Drop` implementation) or after (e.g through `catch_unwind`) the
panic unwinding.

This flaw was corrected in commit [e325e2f](https://github.com/SergioBenitez/Rocket/commit/e325e2fce4d9f9f392761e9fb58b418a48cef8bb)
by using a guard object to ensure that the `&'static str` was dropped inside
the function.
Vulnerability: GHSA-8h4j-vm3r-vcq3
Summary: Use after free in rusqlite
Aliases: CVE-2020-35870
Severity: CRITICAL
CWE: CWE-416
Published: 2021-08-25T20:47:48Z

An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API use-after-free.
Vulnerability: GHSA-gq4h-f254-7cw9
Summary: Data races in ticketed_lock
Severity: MODERATE
CWE: CWE-362
Published: 2021-08-25T21:00:34Z

Affected versions of this crate unconditionally implemented `Send` for `ReadTicket<T>` & `WriteTicket<T>`.
This allows to send non-Send `T` to other threads.

This can allows creating data races by cloning types with internal mutability and sending them to other threads (as `T` of `ReadTicket<T>`/`WriteTicket<T>`). Such data races can cause memory corruption or other undefined behavior.

The flaw was corrected in commit a986a93 by adding `T: Send` bounds to `Send` impls of `ReadTicket<T>`/`WriteTicket<T>`.
Vulnerability: RUSTSEC-2021-0101
Summary: Permissions bypass in pleaser
Aliases: GHSA-vc5p-j8vw-mc6x, CVE-2021-31155
Published: 2021-05-27T12:00:00Z

Failure to normalize the umask in pleaser before 0.4 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.
Vulnerability: GHSA-g83m-67wh-whpw
Summary: Command injection in kekbit
Aliases: CVE-2020-36449
Severity: HIGH
CWE: CWE-77
Published: 2021-08-25T20:57:10Z

An issue was discovered in the kekbit crate before 0.3.4 for Rust. For ShmWriter<H>, Send is implemented without requiring H: Send.
Vulnerability: RUSTSEC-2021-0013
Summary: Soundness issues in `raw-cpuid`
Aliases: CVE-2021-26307, CVE-2021-26306
Published: 2021-01-20T12:00:00Z

## Undefined behavior in `as_string()` methods

`VendorInfo::as_string()`, `SoCVendorBrand::as_string()`,
and `ExtendedFunctionInfo::processor_brand_string()` construct byte slices
using `std::slice::from_raw_parts()`, with data coming from
`#[repr(Rust)]` structs. This is always undefined behavior.

See https://github.com/gz/rust-cpuid/issues/40.

This flaw has been fixed in v9.0.0, by making the relevant structs
`#[repr(C)]`.

## `native_cpuid::cpuid_count()` is unsound

`native_cpuid::cpuid_count()` exposes the unsafe `__cpuid_count()` intrinsic
from `core::arch::x86` or `core::arch::x86_64` as a safe function, and uses
it internally, without checking the
[safety requirement](https://doc.rust-lang.org/core/arch/index.html#overview):

> The CPU the program is currently running on supports the function being
> called.

CPUID is available in most, but not all, x86/x86_64 environments. The crate
compiles only on these architectures, so others are unaffected.

This issue is mitigated by the fact that affected programs are expected
to crash deterministically every time.

See https://github.com/gz/rust-cpuid/issues/41.

The flaw has been fixed in v9.0.0, by intentionally breaking compilation
when targeting SGX or 32-bit x86 without SSE. This covers all affected CPUs.
Vulnerability: GHSA-p24j-h477-76q3
Summary: Uncontrolled Search Path Element in sharkdp/bat
Aliases: CVE-2021-36753
Severity: HIGH
CWE: CWE-427
Published: 2021-08-25T21:01:37Z

bat on windows before 0.18.2 executes programs named less.exe from the current working directory. This can lead to unintended code execution.
Vulnerability: RUSTSEC-2020-0058
Summary: crate has been renamed to `cipher`
Published: 2020-10-15T12:00:00Z

This crate has been renamed from `stream-cipher` to `cipher`.

The new repository location is at:

<https://github.com/RustCrypto/traits/tree/master/cipher>
Vulnerability: RUSTSEC-2019-0025
Summary: Flaw in CBOR deserializer allows stack overflow
Aliases: CVE-2019-25001
Published: 2019-10-03T12:00:00Z

Affected versions of this crate did not properly check if semantic tags were nested excessively during deserialization.

This allows an attacker to craft small (< 1 kB) CBOR documents that cause a stack overflow.
 
The flaw was corrected by limiting the allowed number of nested tags.
Vulnerability: RUSTSEC-2020-0059
Summary: MutexGuard::map can cause a data race in safe code
Aliases: CVE-2020-35905
Published: 2020-10-22T12:00:00Z

Affected versions of the crate had a Send/Sync implementation for MappedMutexGuard that only considered variance on T, while MappedMutexGuard dereferenced to U.

This could of led to data races in safe Rust code when a closure used in MutexGuard::map() returns U that is unrelated to T.

The issue was fixed by fixing `Send` and `Sync` implementations, and by adding a `PhantomData<&'a mut U>` marker to the `MappedMutexGuard` type to tell the compiler that the guard is over
U too.
Vulnerability: RUSTSEC-2019-0024
Summary: Test advisory with associated example crate
Published: 2019-10-08T12:00:00Z

This is a test advisory useful for verifying RustSec tooling and vulnerability
detection pipelines are working correctly. Aside from the fact that it is filed
against an example crate, it is otherwise considered by the Advisory Database
itself to be a normal security advisory.

It's filed against `rustsec-example-crate`, an otherwise completely empty crate
with no functionality or code, which has two releases:

- [v0.0.1] - *vulnerable* according to this advisory
- [v1.0.0] - *patched* by this advisory

(Technically there is a third release, v0.0.0, which is yanked, but otherwise
identical to the v0.0.1 release)

[v0.0.1]: https://crates.io/crates/rustsec-example-crate/0.0.1
[v1.0.0]: https://crates.io/crates/rustsec-example-crate/1.0.0
Vulnerability: RUSTSEC-2021-0012
Summary: Reading uninitialized memory can cause UB (`Deserializer::read_vec`)
Aliases: CVE-2021-26305
Published: 2021-01-02T12:00:00Z

`Deserializer::read_vec()` created an uninitialized buffer and passes it to a user-provided `Read` implementation (`Deserializer.reader.read_exact()`).

Passing an uninitialized buffer to an arbitrary `Read` implementation is currently defined as undefined behavior in Rust. Official documentation for the `Read` trait explains the following: "It is your responsibility to make sure that buf is initialized before calling read. Calling read with an uninitialized buf (of the kind one obtains via MaybeUninit<T>) is not safe, and can lead to undefined behavior."

The flaw was corrected in commit ce310f7 by zero-initializing the newly allocated buffer before handing it to `Deserializer.reader.read_exact()`.
Vulnerability: GHSA-7cjc-hvxf-gqh7
Summary: Use after free and double free in bitvec
Aliases: CVE-2020-35862
Severity: CRITICAL
CWE: CWE-416, CWE-415
Published: 2021-08-25T20:47:39Z

An issue was discovered in the bitvec crate before 0.17.4 for Rust. BitVec to BitBox conversion leads to a use-after-free or double free.
Vulnerability: GHSA-9qj6-4rfq-vm84
Summary: Out-of-bounds Write in actix-web
Aliases: CVE-2018-25024
Severity: CRITICAL
CWE: CWE-787
Published: 2022-01-06T22:20:41Z

An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly coerce an immutable reference into a mutable reference, leading to memory corruption.
Vulnerability: RUSTSEC-2021-0045
Summary: FromIterator implementation for Vector/Matrix can drop uninitialized memory
Aliases: CVE-2021-29936
Published: 2021-01-11T12:00:00Z

The `FromIterator<T>` methods for `Vector` and `Matrix` rely on the type
parameter `N` to allocate space in the iterable.

If the passed in `N` type parameter is larger than the number of items returned
by the iterator, it can lead to uninitialized memory being left in the
`Vector` or `Matrix` type which gets dropped.
Vulnerability: RUSTSEC-2022-0010
Summary: enum_map macro can cause UB when `Enum` trait is incorrectly implemented
Published: 2022-02-17T12:00:00Z

Affected versions of this crate did not properly check the length of an enum when using `enum_map!` macro, trusting user-provided length.

When the `LENGTH` in the `Enum` trait does not match the array length in the `EnumArray` trait, this can result in the initialization of the enum map with uninitialized types, which in turn can allow an attacker to execute arbitrary code.

This problem can only occur with a manual implementation of the Enum trait, it will never occur for enums that use `#[derive(Enum)]`.

Example code that triggers this vulnerability looks like this:

```rust
enum E {
    A,
    B,
    C,
}

impl Enum for E {
    const LENGTH: usize = 2;

    fn from_usize(value: usize) -> E {
        match value {
            0 => E::A,
            1 => E::B,
            2 => E::C,
            _ => unimplemented!(),
        }
    }

    fn into_usize(self) -> usize {
        self as usize
    }
}

impl<V> EnumArray<V> for E {
    type Array = [V; 3];
}

let _map: EnumMap<E, String> = enum_map! { _ => "Hello, world!".into() };
```

The flaw was corrected in commit [b824e23](https://gitlab.com/KonradBorowski/enum-map/-/commit/b824e232f2fb47837740070096ac253df8e80dfc) by putting `LENGTH` property on sealed trait for macro to read.
Vulnerability: GHSA-9p9m-9xww-qjcx
Summary: Array size is not checked in sized-chunks
Aliases: CVE-2020-25791
Severity: HIGH
CWE: CWE-129
Published: 2021-08-25T20:45:06Z

An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with unit().
Vulnerability: RUSTSEC-2021-0100
Summary: Miscomputed results when using AVX2 backend
Published: 2021-09-08T12:00:00Z

The v0.9.7 release of the `sha2` crate introduced a new AVX2-accelerated
backend which was automatically enabled for all x86/x86_64 CPUs where AVX2
support was autodetected at runtime.

This backend was buggy and would miscompute results for long messages
(i.e. messages spanning multiple SHA blocks).

The crate has since been yanked, but any users who upgraded to v0.9.7 should
immediately upgrade to v0.9.8 and recompute any hashes which were previously
computed by v0.9.7.
Vulnerability: GHSA-rw2c-c256-3r53
Summary: Data races in hashconsing
Aliases: CVE-2020-36215
Severity: HIGH
CWE: CWE-662, CWE-787
Published: 2021-08-25T20:51:52Z

An issue was discovered in the hashconsing crate before 1.1.0 for Rust. Because HConsed does not have bounds on its Send trait or Sync trait, memory corruption can occur.
Vulnerability: GHSA-j8qq-58cr-8cc7
Summary: Out of bounds read in bra
Aliases: CVE-2021-25905
Severity: CRITICAL
CWE: CWE-908, CWE-125
Published: 2021-08-25T20:52:53Z

Buffered Random Access (BRA) provides easy random memory access to a sequential source of data in Rust. This is achieved by greedily retaining all memory read from a given source. Buffered Random Access (BRA) provides easy random memory access to a sequential source of data in Rust. An issue was discovered in the bra crate before 0.1.1 for Rust. It lacks soundness because it can read uninitialized memory.
Vulnerability: RUSTSEC-2020-0018
Summary: crate has been renamed to `block-cipher`
Published: 2020-05-26T12:00:00Z

This crate has been renamed from `block-cipher-trait` to `block-cipher`.

The new repository location is at:

<https://github.com/RustCrypto/traits/tree/master/block-cipher>
Vulnerability: RUSTSEC-2022-0006
Summary: Data race in `Iter` and `IterMut`
Published: 2022-01-23T12:00:00Z

In the affected version of this crate, `{Iter, IterMut}::next` used a weaker memory ordering when loading values than what was required, exposing a potential data race
when iterating over a `ThreadLocal`'s values.

Crates using `Iter::next`, or `IterMut::next` are affected by this issue.
Vulnerability: GHSA-q2gj-9r85-p832
Summary: Data races in rulinalg
Aliases: CVE-2020-35879
Severity: CRITICAL
CWE: CWE-362
Published: 2021-08-25T20:48:09Z

An issue was discovered in the rulinalg crate through 2020-02-11 for Rust. There are incorrect lifetime-boundary definitions for RowMut::raw_slice and RowMut::raw_slice_mut.
Vulnerability: RUSTSEC-2021-0053
Summary: 'merge_sort::merge()' crashes with double-free for `T: Drop`
Aliases: CVE-2021-31996
Published: 2021-03-07T12:00:00Z

In the affected versions of this crate, `merge_sort::merge()` wildly duplicates and drops ownership of `T` without guarding against double-free. Due to such implementation,
simply invoking `merge_sort::merge()` on `Vec<T: Drop>` can cause **double free** bugs.
Vulnerability: RUSTSEC-2021-0116
Summary: `BinaryArray` does not perform bound checks on reading values and offsets
Published: 2021-09-14T12:00:00Z

`BinaryArray` performs insufficient validation on creation, which allows out-of-bounds reads in safe code.
Vulnerability: GHSA-3288-cwgw-ch86
Summary: Unchecked Return Value in xcb
Aliases: CVE-2021-26955
Severity: CRITICAL
CWE: CWE-252
Published: 2021-08-25T20:53:22Z

An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because xcb::xproto::GetAtomNameReply::name() calls std::str::from_utf8_unchecked() on unvalidated bytes from an X server.
Vulnerability: GHSA-xmr7-v725-2jjr
Summary: XSS in comrak
Aliases: CVE-2021-27671
Severity: MODERATE
CWE: CWE-79
Published: 2021-08-25T20:52:12Z

An issue was discovered in the comrak crate before 0.9.1 for Rust. XSS can occur because the protection mechanism for data: and javascript: URIs is case-sensitive, allowing (for example) Data: to be used in an attack.
Vulnerability: GHSA-fgfm-hqjw-3265
Summary: Out-of-bounds Write in actix-web
Aliases: CVE-2018-25025
Severity: CRITICAL
CWE: CWE-787
Published: 2022-01-06T22:18:46Z

An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string, leading to memory corruption.
Vulnerability: RUSTSEC-2019-0032
Summary: crust repo has been archived; use libp2p instead
Published: 2019-11-21T12:00:00Z

** The `crust` crate repo was archived with no warning or explanation.**

Given that it was archived with no warning or successor, there's not an
official replacement but [`rust-libp2p`](https://github.com/libp2p/rust-libp2p)
looks like it's got a similar feature set and is actively maintained.
Vulnerability: RUSTSEC-2021-0004
Summary: Missing Send bound for Lazy
Aliases: CVE-2021-25901
Published: 2021-01-17T12:00:00Z

All current versions of this crate allow causing data races in safe code.

The flaw will be fixed in the next release.
Vulnerability: GHSA-69gw-hgj3-45m7
Summary: Memory corruption in smallvec
Aliases: CVE-2019-15554
Severity: CRITICAL
CWE: CWE-787
Published: 2021-08-25T20:43:58Z

An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is memory corruption for certain grow attempts with less than the current capacity.
Vulnerability: GHSA-w4cc-pc2h-whcj
Summary: Out-of-bounds Write in derive-com-impl
Aliases: CVE-2021-45681
Severity: HIGH
CWE: CWE-787
Published: 2022-01-06T22:16:10Z

An issue was discovered in the derive-com-impl crate before 0.1.2 for Rust. An invalid reference (and memory corruption) can occur because AddRef might not be called before returning a pointer.
Vulnerability: RUSTSEC-2020-0034
Summary: Multiple security issues including data race, buffer overflow, and uninitialized memory drop
Aliases: CVE-2020-35886, CVE-2020-35887, CVE-2020-35888
Published: 2020-08-25T12:00:00Z

`arr` crate contains multiple security issues. Specifically,

1. It incorrectly implements Sync/Send bounds, which allows to smuggle non-Sync/Send types across the thread boundary.
2. `Index` and `IndexMut` implementation does not check the array bound.
3. `Array::new_from_template()` drops uninitialized memory.
Vulnerability: GHSA-hvqc-pc78-x9wh
Summary: Soundness issue in raw-cpuid
Aliases: CVE-2021-26306
Severity: HIGH
CWE: CWE-198
Published: 2021-08-25T20:53:10Z

An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust. It has unsound transmute calls within as_string() methods.
Vulnerability: RUSTSEC-2021-0090
Summary: Reading on uninitialized memory may cause UB ( `util::read_spv()` )
Published: 2021-01-07T12:00:00Z

Affected versions of this crate passes an uninitialized buffer to a user-provided `Read` implementation.

Arbitrary `Read` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer.
Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.
Vulnerability: GHSA-cwvc-87xq-pc5m
Summary: Out-of-bounds Write and Race Condition in metrics-util
Aliases: CVE-2021-45704
Severity: HIGH
CWE: CWE-787, CWE-362
Published: 2022-01-06T22:08:43Z

An issue was discovered in the metrics-util crate before 0.7.0 for Rust. There is a data race and memory corruption because AtomicBucket<T> unconditionally implements the Send and Sync traits.
Vulnerability: GHSA-gffv-5hr2-f9gj
Summary: Incorrect results in orion
Aliases: CVE-2018-20999
Severity: HIGH
CWE: CWE-682
Published: 2021-08-25T20:43:18Z

An issue was discovered in the orion crate before 0.11.2 for Rust. reset() calls cause incorrect results.
Vulnerability: GHSA-f6g6-54hm-fhxv
Summary: Data races in libsbc
Aliases: CVE-2020-36440
Severity: HIGH
CWE: CWE-119, CWE-362
Published: 2021-08-25T20:59:02Z

Affected versions of this crate implements `Send` for `Decoder<R>` for any `R: Read`. This allows `Decoder<R>` to contain `R: !Send` and carry (move) it to another thread.

This can result in undefined behavior such as memory corruption from data race on `R`, or dropping `R = MutexGuard<_>` from a thread that didn't lock the mutex.

The flaw was corrected in commit a34d6e1 by adding trait bound `R: Send` to the `Send` impl for `Decoder<R>`.
Vulnerability: RUSTSEC-2018-0002
Summary: Links in archives can overwrite any existing file
Aliases: CVE-2018-20990
Published: 2018-06-29T12:00:00Z

When unpacking a tarball with the `unpack_in`-family of functions it's intended
that only files within the specified directory are able to be written. Tarballs
with hard links or symlinks, however, can be used to overwrite any file on the
filesystem.

Tarballs can contain multiple entries for the same file. A tarball which first
contains an entry for a hard link or symlink pointing to any file on the
filesystem will have the link created, and then afterwards if the same file is
listed in the tarball the hard link will be rewritten and any file can be
rewritten on the filesystem.

This has been fixed in https://github.com/alexcrichton/tar-rs/pull/156 and is
published as `tar` 0.4.16. Thanks to Max Justicz for discovering this and
emailing about the issue!
Vulnerability: RUSTSEC-2020-0063
Summary: crate has been renamed to `safe-nd`
Published: 2020-11-02T12:00:00Z

This crate has been renamed from `safe-nd` to `sn_data_types`.

The new repository location is:

<https://github.com/maidsafe/sn_data_types>
Vulnerability: GHSA-mm7v-vpv8-xfc3
Summary: Double free in smallvec
Aliases: CVE-2019-15551
Severity: CRITICAL
CWE: CWE-415
Published: 2021-08-25T20:44:59Z

An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is a double free for certain grow attempts with the current capacity.
Vulnerability: RUSTSEC-2020-0126
Summary: SyncChannel<T> can move 'T: !Send' to other threads
Aliases: CVE-2020-36446
Published: 2020-11-15T12:00:00Z

Affected versions of this crate unconditionally implement Send/Sync for `SyncChannel<T>`.
`SyncChannel<T>` doesn't provide access to `&T` but merely serves as a channel that consumes and returns owned `T`.

Users can create UB in safe Rust by sending `T: !Send` to other threads with `SyncChannel::send/recv` APIs. Using `T = Arc<Cell<_>` allows to create data races (which can lead to memory corruption), and using `T = MutexGuard<T>` allows to unlock a mutex from a thread that didn't lock the mutex.
Vulnerability: GHSA-4hjg-cx88-g9f9
Summary: Data races in futures-intrusive
Aliases: CVE-2020-35915
Severity: MODERATE
CWE: CWE-362
Published: 2021-08-25T20:49:58Z

An issue was discovered in the futures-intrusive crate before 0.4.0 for Rust. GenericMutexGuard allows cross-thread data races of non-Sync types.
Vulnerability: RUSTSEC-2021-0028
Summary: Multiple memory safety issues in insert_row
Aliases: CVE-2021-28029, CVE-2021-28028
Published: 2021-02-19T12:00:00Z

When inserting rows from an iterator at a particular index, `toodee` would shift
items over, duplicating their ownership. The space reserved for the new elements
was based on the `len()` returned by the `ExactSizeIterator`.

This could result in elements in the array being freed twice if the iterator
panics. Uninitialized or previously freed elements could also be exposed if the
`len()` didn't match the number of elements.

These issues were fixed in commit `ced70c17` by temporarily setting the length
of the array smaller while processing it and adding assertions on the number
of elements returned by the iterator.
Vulnerability: GHSA-j79j-cx3h-g27h
Summary: Out of bounds write in traitobject
Aliases: CVE-2020-35881
Severity: CRITICAL
CWE: CWE-787
Published: 2021-08-25T20:48:02Z

An issue was discovered in the traitobject crate through 2020-06-01 for Rust. It has false expectations about fat pointers, possibly causing memory corruption in, for example, Rust 2.x.
Vulnerability: GHSA-mcrf-7hf9-f6q5
Summary: Unchecked vector pre-allocation
Severity: MODERATE
CWE: CWE-400
Published: 2021-08-25T21:00:09Z

Affected versions of this crate pre-allocate memory on deserializing raw
buffers without checking whether there is sufficient data available.

This allows an attacker to do denial-of-service attacks by sending small
msgpack messages that allocate gigabytes of memory.
Vulnerability: RUSTSEC-2019-0008
Summary: Flaw in string parsing can lead to crashes due to invalid memory access.
Aliases: CVE-2019-15550
Published: 2019-06-24T12:00:00Z

The affected version of this crate did not guard against accessing memory
beyond the range of its input data. A pointer cast to read the data into
a 256-bit register could lead to a segmentation fault when the end plus
the 32 bytes (256 bit) read would overlap into the next page during string
parsing.

```
page   |  ...  page 1  ...  | ... page 2  ... |
data   | x[n * 32 byte]xx__ |                 |
access | ..][ 32 byte ]     |                 |
segflt |               [ 32 | byte ]          |
```

This allows an attacker to eventually crash a service.

The flaw was corrected by using a padding buffer for the last read from the
input. So that we are we never read over the boundary of the input data.
Vulnerability: RUSTSEC-2020-0075
Summary: Unexpected panic when decoding tokens
Aliases: CVE-2020-35918
Published: 2020-11-29T12:00:00Z

Prior to `0.10.0` it was possible to have both decoding functions panic unexpectedly,
by supplying tokens with an incorrect base62 encoding.

The documentation stated that an error should have been reported instead.
Vulnerability: RUSTSEC-2020-0130
Summary: Bunch<T> unconditionally implements Send/Sync
Aliases: CVE-2020-36450
Published: 2020-11-12T12:00:00Z

Affected versions of this crate unconditionally implements `Send`/`Sync` for `Bunch<T>`.
This allows users to insert `T: !Sync` to `Bunch<T>`. It is possible to create a data race to a `T: !Sync` by invoking the `Bunch::get()` API (which returns `&T`) from multiple threads. It is also possible to send `T: !Send` to other threads by inserting `T` inside `Bunch<T>` and sending `Bunch<T>` to another thread, allowing to create a data race by inserting types like `T = Rc<_>`.

Such data races can lead to memory corruption.
Vulnerability: GHSA-pphf-f93w-gc84
Summary: Data race in may_queue
Aliases: CVE-2020-36217
Severity: MODERATE
CWE: CWE-662, CWE-787
Published: 2021-08-25T20:51:47Z

An issue was discovered in the may_queue crate through 2020-11-10 for Rust. Because Queue does not have bounds on its Send trait or Sync trait, memory corruption can occur.
Vulnerability: GHSA-vhfr-v4w9-45v8
Summary: Improper Input Validation in renderdoc
Aliases: CVE-2019-16142
Severity: HIGH
CWE: CWE-20
Published: 2021-08-25T20:44:51Z

An issue was discovered in the renderdoc crate before 0.5.0 for Rust. Multiple exposed methods take self by immutable reference, which is incompatible with a multi-threaded application.
Vulnerability: GHSA-wq8f-46ww-6c2h
Summary: Integer underflow in untrusted
Aliases: CVE-2018-20989
Severity: HIGH
CWE: CWE-191
Published: 2021-08-25T20:43:49Z

An issue was discovered in the untrusted crate before 0.6.2 for Rust. Error handling can trigger an integer underflow and panic.
Vulnerability: RUSTSEC-2020-0022
Summary: Ozone contains several memory safety issues
Aliases: CVE-2020-35877, CVE-2020-35878
Published: 2020-07-04T12:00:00Z

Ozone contains several memory safety issues including [out-of-bound access](https://github.com/bqv/ozone/blob/e21f948b0178ab305f644118f18d87a838c618e0/src/buffer.rs#L38-L48)
and dropping of [uninitialized memory](https://github.com/bqv/ozone/blob/e21f948b0178ab305f644118f18d87a838c618e0/src/map.rs#L94-L101).
Vulnerability: GHSA-qj3v-q2vj-4c8h
Summary: Calculation error in ark-r1cs-std
Aliases: CVE-2021-38194
Severity: CRITICAL
CWE: CWE-682
Published: 2021-08-25T20:55:58Z

An issue was discovered in the ark-r1cs-std crate before 0.3.1 for Rust. It does not enforce any constraints in the FieldVar::mul_by_inverse method. Thus, a prover can produce a proof that is unsound but is nonetheless verified.
Vulnerability: RUSTSEC-2017-0006
Summary: Unchecked vector pre-allocation
Published: 2017-11-21T12:00:00Z

Affected versions of this crate pre-allocate memory on deserializing raw
buffers without checking whether there is sufficient data available.

This allows an attacker to do denial-of-service attacks by sending small
msgpack messages that allocate gigabytes of memory.
Vulnerability: GHSA-686f-ch3r-xwmh
Summary: Data races in unicycle
Aliases: CVE-2020-36436
Severity: HIGH
CWE: CWE-119, CWE-362
Published: 2021-08-25T20:58:17Z

Affected versions of this crate unconditionally implemented `Send` & `Sync` for types `PinSlab<T>` & `Unordered<T, S>`. This allows sending non-Send types to other threads and concurrently accessing non-Sync types from multiple threads.

This can result in a data race & memory corruption when types that provide internal mutability without synchronization are contained within `PinSlab<T>` or `Unordered<T, S>` and accessed concurrently from multiple threads.

The flaw was corrected in commits 92f40b4 & 6a6c367 by adding trait bound `T: Send` to `Send` impls for `PinSlab<T>` & `Unordered<T, S>` and adding `T: Sync` to `Sync` impls for `PinSlab<T>` & `Unordered<T, S>`.
Vulnerability: GHSA-9mxw-4856-9cm5
Summary: Data races in rusb
Aliases: CVE-2020-36206
Severity: HIGH
CWE: CWE-662, CWE-787
Published: 2021-08-25T20:50:51Z

An issue was discovered in the rusb crate before 0.7.0 for Rust. Because of a lack of Send and Sync bounds, a data race and memory corruption can occur.
Vulnerability: GHSA-39vw-qp34-rmwf
Summary: Uncontrolled recursion leads to abort in deserialization
Severity: MODERATE
CWE: CWE-674
Published: 2021-08-25T21:00:18Z

Affected versions of this crate did not properly check for recursion
while deserializing aliases.

This allows an attacker to make a YAML file with an alias referring
to itself causing an abort.

The flaw was corrected by checking the recursion depth.
Vulnerability: GHSA-v7q4-97x4-4qw2
Summary:  Use of Uninitialized Resource in truetype
Aliases: CVE-2021-28030
Severity: HIGH
CWE: CWE-908
Published: 2021-08-25T20:51:58Z

An issue was discovered in the truetype crate before 0.30.1 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation within Tape::take_bytes.
Vulnerability: RUSTSEC-2021-0086
Summary: `Read` on uninitialized buffer may cause UB ( `read_entry()` )
Published: 2021-01-07T12:00:00Z

Affected versions of this crate passes an uninitialized buffer to a user-provided `Read` implementation.
There are two of such cases (`go_offset_log::read_entry()` & `offset_log::read_entry()`).

Arbitrary `Read` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer.
Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.
Vulnerability: RUSTSEC-2018-0014
Summary: chan is end-of-life; use crossbeam-channel instead
Published: 2018-07-31T12:00:00Z

**`chan` has reached its end-of-life and is now deprecated.**

The intended successor of this crate is
[`crossbeam-channel`](https://github.com/crossbeam-rs/crossbeam/tree/master/crossbeam-channel).
Its API is strikingly similar, but comes with a much better `select!` macro,
better performance, a better test suite and an all-around better
implementation.
Vulnerability: RUSTSEC-2021-0069
Summary: SMTP command injection in body
Aliases: GHSA-qc36-q22q-cjw3, CVE-2021-38189
Published: 2021-05-22T12:00:00Z

Affected versions of lettre allowed SMTP command injection through an attacker's controlled message body. The module for escaping lines starting with a period wouldn't catch a period that was placed after a double CRLF sequence, allowing the attacker to end the current message and write arbitrary SMTP commands after it.

The flaw is fixed by correctly handling consecutive CRLF sequences.
Vulnerability: RUSTSEC-2019-0028
Summary: Unsound `impl Follow for bool`
Aliases: CVE-2019-25004
Published: 2019-10-20T12:00:00Z

The implementation of `impl Follow for bool` allows to reinterpret arbitrary bytes as a `bool`.

In Rust `bool` has stringent requirements for its in-memory representation. Use of this function
allows to violate these requirements and invoke undefined behaviour in safe code.
Vulnerability: GHSA-x54v-qxxr-93qc
Summary: Missing release of memory in sized-chunks
Aliases: CVE-2020-25795
Severity: HIGH
CWE: CWE-401
Published: 2021-08-25T20:45:01Z

An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, insert_from can have a memory-safety issue upon a panic.
Vulnerability: RUSTSEC-2021-0049
Summary: `through` and `through_and` causes a double free if the map function panics
Aliases: CVE-2021-29940
Published: 2021-02-18T12:00:00Z

`through` and `through_and` take a mutable reference as well as a mapping
function to change the provided reference. They do this by calling `ptr::read`
on the reference which duplicates ownership and then calling the mapping
function.

If the mapping function panics, both the original object and the one
duplicated by `ptr::read` get dropped, causing a double free.
Vulnerability: GHSA-2rxc-8f9w-fjq8
Summary: Window may read from uninitialized memory locations in rdiff
Aliases: CVE-2021-45694
Severity: HIGH
CWE: CWE-908
Published: 2022-01-06T22:14:13Z

An issue was discovered in the rdiff crate through 2021-02-03 for Rust. Window may read from uninitialized memory locations.
Vulnerability: RUSTSEC-2020-0147
Summary: rulinalg is unmaintained, use nalgebra instead
Published: 2020-02-11T12:00:00Z

The `rulinalg` crate is no longer maintained, use [nalgebra](https://crates.io/crates/nalgebra)
instead.
Vulnerability: RUSTSEC-2020-0002
Summary: Parsing a specially crafted message can result in a stack overflow
Aliases: CVE-2020-35858
Published: 2020-01-16T12:00:00Z

Affected versions of this crate contained a bug in which decoding untrusted
input could overflow the stack.

On architectures with stack probes (like x86), this can be used for denial of
service attacks, while on architectures without stack probes (like ARM)
overflowing the stack is unsound and can result in potential memory corruption
(or even RCE).
 
The flaw was quickly corrected by @danburkert and released in version 0.6.1.
Vulnerability: RUSTSEC-2020-0151
Summary: Generators can cause data races if non-Send types are used in their generator functions
Aliases: CVE-2020-36471
Published: 2020-11-16T12:00:00Z

The `Generator` type is an iterable which uses a generator function that yields
values. In affected versions of the crate, the provided function yielding values
had no `Send` bounds despite the `Generator` itself implementing `Send`.

The generator function lacking a `Send` bound means that types that are
dangerous to send across threads such as `Rc` could be sent as part of a
generator, potentially leading to data races.

This flaw was fixed in commit [`f7d120a3b`](https://github.com/Xudong-Huang/generator-rs/commit/f7d120a3b724d06a7b623d0a4306acf8f78cb4f0)
by enforcing that the generator function be bound by `Send`.
Vulnerability: RUSTSEC-2020-0014
Summary: Various memory safety issues
Aliases: CVE-2020-35873, CVE-2020-35868, CVE-2020-35870, CVE-2020-35867, CVE-2020-35872, CVE-2020-35871, CVE-2020-35869, CVE-2020-35866
Published: 2020-04-23T12:00:00Z

Several memory safety issues have been uncovered in an audit of
rusqlite.

See https://github.com/rusqlite/rusqlite/releases/tag/0.23.0 for a complete list.
Vulnerability: RUSTSEC-2021-0008
Summary: reading on uninitialized buffer can cause UB (`impl<R> BufRead for GreedyAccessReader<R>`)
Aliases: CVE-2021-25905
Published: 2021-01-02T12:00:00Z

Affected versions of this crate creates an uninitialized buffer and passes it to user-provided `Read` implementation.

This is unsound, because it allows safe Rust code to exhibit an undefined behavior (read from uninitialized memory).

The flaw was corrected in version 0.1.1 by zero-initializing a newly allocated buffer
before handing it to a user-provided `Read` implementation.
Vulnerability: GHSA-hf79-8hjp-rrvq
Summary: Use After Free in lucet
Aliases: CVE-2021-43790
Severity: HIGH
CWE: CWE-416
Published: 2021-11-30T22:20:36Z

### Impact
There is a bug in the main branch of Lucet's `lucet-runtime` that allows a use-after-free in an `Instance` object that could result in memory corruption, data race, or other related issues.  This bug was introduced early in the development of Lucet and is present in all releases.  As a result of this bug, and dependent on the memory backing for the `Instance` objects, it is possible to trigger a use-after-free when the `Instance` is dropped.

### Patches
Users should upgrade to the `main` branch of the Lucet repository. Lucet does not provide versioned releases on crates.io.

### Workarounds
There is no way to remediate this vulnerability without upgrading.

### Description
Lucet uses a "pool" allocator for new WebAssembly instances that are created. This pool allocator manages everything from the linear memory of the wasm instance, the runtime stack for async switching, as well as the memory behind the Instance itself. `Instances` are referred to via an `InstanceHandle` type which will, on drop, release the memory backing the Instance back to the pool.

When an Instance is dropped, the fields of the `Instance` are destructed top-to-bottom, however when the `alloc: Alloc` field is destructed, the memory backing the `Instance` is released back to the pool before the destructors of the remaining fields are run. If another thread allocates the same memory from the pool while these destructors are still running, a race condition occurs that can lead to use-after-free errors.

The bug was corrected by changing how the `InstanceHandle` destructor operates to ensure that the memory backing an Instance is only returned to the pool once the `Instance` has been completely destroyed.

This security advisory has been assigned CVE-2021-43790.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [lucet repository](https://github.com/bytecodealliance/lucet)
* Email [the lucet team](mailto:lucet@fastly.com)
* See the [Bytecode Alliance security policy](https://bytecodealliance.org/security)
Vulnerability: RUSTSEC-2020-0106
Summary: Queues allow non-Send types to be sent to other threads, allowing data races
Aliases: CVE-2020-36214
Published: 2020-12-19T12:00:00Z

Affected versions of this crate unconditionally implemented `Send` for types used in queue implementations (`InnerSend<RW, T>`, `InnerRecv<RW, T>`, `FutInnerSend<RW, T>`, `FutInnerRecv<RW, T>`).

This allows users to send non-Send types to other threads, which can lead to data race bugs or other undefined behavior.

The flaw was corrected in v0.1.7 by adding `T: Send` bound to to the `Send` impl of four data types explained above.
Vulnerability: RUSTSEC-2020-0043
Summary: Insufficient size checks in outgoing buffer in ws allows remote attacker to run the process out of memory
Aliases: CVE-2020-35896
Published: 2020-09-25T12:00:00Z

Affected versions of this crate did not properly check and cap the growth of the outgoing buffer.

This allows a remote attacker to take down the process by growing the buffer of their (single) connection until the process runs out of memory it can allocate and is killed.

The flaw was corrected in the [`parity-ws` fork](https://crates.io/crates/parity-ws) (>=0.10.0) by [disconnecting a client when the buffer runs full](https://github.com/housleyjk/ws-rs/pull/328).
Vulnerability: GHSA-cx4j-fxr7-jxg8
Summary: Double free in glsl-layout
Aliases: CVE-2021-25902
Severity: HIGH
CWE: CWE-415
Published: 2021-08-25T20:53:01Z

An issue was discovered in the glsl-layout crate before 0.4.0 for Rust. When a panic occurs, map_array can perform a double drop.
Vulnerability: GHSA-hr52-f9vp-582c
Summary: Use of Uninitialized Resource in messagepack-rs.
Aliases: CVE-2021-45692
Severity: CRITICAL
CWE: CWE-908
Published: 2022-01-06T22:12:28Z

An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_extension_others may read from uninitialized memory locations.
Vulnerability: GHSA-m2pf-hprp-3vqm
Summary: Use after free in image
Aliases: CVE-2019-16138
Severity: CRITICAL
CWE: CWE-416
Published: 2021-08-25T20:44:43Z

An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution.
Vulnerability: RUSTSEC-2021-0073
Summary: Conversion from `prost_types::Timestamp` to `SystemTime` can cause an overflow and panic
Aliases: CVE-2021-38192
Published: 2021-07-08T12:00:00Z

Affected versions of this crate contained a bug in which untrusted input could cause an overflow and panic when converting a `Timestamp` to `SystemTime`.

It is recommended to upgrade to `prost-types` v0.8 and switch the usage of `From<Timestamp> for SystemTime` to `TryFrom<Timestamp> for SystemTime`.

See [#438] for more information.

[#438]: https://github.com/tokio-rs/prost/issues/438
Vulnerability: RUSTSEC-2020-0038
Summary: Memory safety issues in `compact::Vec`
Aliases: CVE-2020-35890, CVE-2020-35891
Published: 2020-09-03T12:00:00Z

`compact::Vec` contains multiple memory safety issues.

1. It mishandles large capacity and causes out-of-bound access in 32-bit / allocator layout mismatch in 64-bit.
2. `remove()` is not panic-safe and causes double-free when an index larger than the length is provided.
Vulnerability: GHSA-gv73-9mwv-fwgq
Summary: Out of bounds write in prost
Aliases: CVE-2020-35858
Severity: CRITICAL
CWE: CWE-787
Published: 2021-08-25T20:46:11Z

An issue was discovered in the prost crate before 0.6.1 for Rust. There is stack consumption via a crafted message, causing a denial of service (e.g., x86) or possibly remote code execution (e.g., ARM).
Vulnerability: RUSTSEC-2021-0024
Summary: crate has been renamed to `sn_api`
Published: 2021-02-15T12:00:00Z

This crate has been renamed from `safe-api` to `sn_api`.

The new repository location is:

<https://github.com/maidsafe/sn_api>