TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-gjrj-9rj4-pgwx
Summary: DoS Vulnerability from Upstream Actix Web Issues
Severity: HIGH
Published: 2021-12-15T22:51:07Z

### Impact
This vulnerability affects all users of the `perseus deploy` functionality who have not exported their sites to static files. If you are using the inbuilt Perseus server in production, there is a memory leak in Actix Web stemming from [this upstream issue](https://github.com/actix/actix-web/issues/1780) which can allow even a single user to cause the process to exhaust its memory on low-memory servers by continuously reloading the page. Note that this issue does not affect all Actix Web applications, but rather results from certain usage patterns which appear to be present in Perseus' server mechanics.

### Patches
This vulnerability is addressed in all versions after Perseus `v0.3.0-beta.21`, which temporarily discontinues the use of `perseus-actix-web` (until the upstream bug is fixed) and switches to `perseus-warp` instead, which utilizes [Warp](https://github.com/seanmonstar/warp).

Additionally, as of Perseus `v0.3.0-beta.22`, the Actix Web integration has been upgraded to use the latest unstable beta version of Actix Web, which appears to partially resolve this issue (the severity of the memory leak is reduced). However, due to the instability of this version, the default integration will remain Warp for now, and a warning will appear if you attempt to use the Actix Web integration.

<details>
<summary>Using the Actix Web integration</summary>

If the instability of the latest beta version of Actix Web is not a concern for you, you can use this integration by adding `-i actix-web` to `perseus serve` and the like. This will print a warning about instability, and will then operate with the beta version. Please report any failures in functionality that are not security-related to the Perseus team by [opening an issue on the repository](https://github.com/arctic-hen7/perseus/issues/new/choose).

Note however that switching to the Warp integration requires no code changes whatsoever unless you've ejected, so there are very few disadvantages to this change.

</details>

### Workarounds
Due to significant infrastructural changes within other Perseus packages that were needed to support Warp, this integration is not backward-compatible with any previous version of Perseus, meaning there are no easily feasible workarounds. If you're only in development though, this vulnerability is irrelevant until you push to production.

### CVE Status

Due to GitHub's requirements, a CVE can't be issued for this security advisory because the issue is technically one with Actix Web (though it's only in combination with certain mechanics in the Perseus server that this problem arises).

### References
See [this upstream issue](https://github.com/actix/actix-web/issues/1780) in Actix Web.

### For more information
If you have any questions or comments about this advisory:
* Open an issue on this repository
* Email me at [arctic_hen7@pm.me](mailto:arctic_hen7@pm.me)
Vulnerability: GHSA-7x36-h62w-vw65
Summary: Out-of-bounds Write in actix-web
Aliases: CVE-2018-25026
Severity: CRITICAL
CWE: CWE-787
Published: 2022-01-06T22:18:58Z

An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely, leading to memory corruption.
Vulnerability: GHSA-vjmg-pc8h-p6p8
Summary: Out of bounds read in fltk
Aliases: CVE-2021-28308
Severity: CRITICAL
CWE: CWE-125
Published: 2021-08-25T20:53:58Z

An issue was discovered in the fltk crate before 0.15.3 for Rust. There is an out-of bounds read because the pixmap constructor lacks pixmap input validation.
Vulnerability: GHSA-rh7x-ppxx-p34c
Summary: Insufficient size checks in ws
Aliases: CVE-2020-35896
Severity: HIGH
CWE: CWE-400
Published: 2021-08-25T20:49:32Z

An issue was discovered in the ws crate through 2020-09-25 for Rust. The outgoing buffer is not properly limited, leading to a remote memory-consumption attack.
Vulnerability: RUSTSEC-2020-0008
Summary: Flaw in hyper allows request smuggling by sending a body in GET requests
Aliases: CVE-2020-35863
Published: 2020-03-19T12:00:00Z

Vulnerable versions of hyper allow GET requests to have bodies, even if there is
no Transfer-Encoding or Content-Length header.  As per the HTTP 1.1
specification, such requests do not have bodies, so the body will be interpreted
as a separate HTTP request.

This allows an attacker who can control the body and method of an HTTP request
made by hyper to inject a request with headers that would not otherwise be
allowed, as demonstrated by sending a malformed HTTP request from a Substrate
runtime.  This allows bypassing CORS restrictions.  In combination with other
vulnerabilities, such as an exploitable web server listening on loopback, it may
allow remote code execution.

The flaw was corrected in hyper version 0.12.34.
Vulnerability: RUSTSEC-2021-0043
Summary: PartialReader passes uninitialized memory to user-provided Read
Aliases: CVE-2021-29934
Published: 2021-02-17T12:00:00Z

Affected versions of this crate passed an uniniitalized buffer to a
user-provided `Read` instance in `PartialReader::read`.

This can result in safe `Read` implementations reading from the uninitialized
buffer leading to undefined behavior.

The flaw was fixed in commit [`39d62c6`](https://github.com/uutils/coreutils/commit/39d62c6c1f809022c903180471c10fde6ecd12d1)
by zero-initializing the passed buffer.
Vulnerability: RUSTSEC-2022-0016
Summary: Use after free with `externref`s and epoch interruption in Wasmtime
Aliases: CVE-2022-24791
Published: 2022-03-31T12:00:00Z

[Use after free with `externref`s and epoch interruption in Wasmtime](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gwc9-348x-qwv2)
Vulnerability: GHSA-48vq-8jqv-gm6f
Summary: Remote memory exhaustion in ckb
Severity: HIGH
CWE: CWE-400
Published: 2021-08-25T21:01:23Z

In the ckb sync protocol, SyncState maintains a HashMap called 'misbehavior' that keeps a score of a peer's violations of the protocol. This HashMap is keyed to PeerIndex (an alias for SessionId), and entries are never removed from it. SessionId is an integer that increases monotonically with every new connection.

A remote attacker can manipulate this HashMap to grow forever, resulting in degraded performance and ultimately a panic on allocation failure or being killed by the OS, depending on the platform.

This is a critical severity security bug. It could be exploited to create a targeted or network-wide denial of service, to reduce the hash power of the network as part of a 51% attack, and perhaps in other creative ways.

An attack is trivial:

1. connect to another node
2. send an invalid sync protocol request, such as `SendHeaders` for non-consecutive blocks
3. disconnect
4. repeat
Vulnerability: GHSA-gmv4-vmx3-x9f3
Summary: Data races in lock_api
Aliases: CVE-2020-35914
Severity: MODERATE
CWE: CWE-362
Published: 2021-08-25T20:49:37Z

An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of RwLockWriteGuard unsoundness.
Vulnerability: GHSA-cgmg-2v6m-fjg7
Summary: Free of uninitialized memory in autorand
Aliases: CVE-2020-36210
Severity: HIGH
CWE: CWE-908
Published: 2021-08-25T20:50:41Z

An issue was discovered in the autorand crate before 0.2.3 for Rust. Because of impl Random on arrays, uninitialized memory can be dropped when a panic occurs, leading to memory corruption.
Vulnerability: RUSTSEC-2021-0106
Summary: Uncontrolled Search Path Element in sharkdp/bat
Aliases: GHSA-p24j-h477-76q3, CVE-2021-36753
Published: 2021-07-15T12:00:00Z

bat on windows before 0.18.2 executes programs named less.exe from the current working directory. This can lead to unintended code execution.
Vulnerability: RUSTSEC-2021-0055
Summary: NULL pointer deref in signature_algorithms processing
Aliases: CVE-2021-3449
Published: 2021-05-01T12:00:00Z

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation
ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits
the signature_algorithms extension (where it was present in the initial
ClientHello), but includes a signature_algorithms_cert extension then a NULL
pointer dereference will result, leading to a crash and a denial of service
attack.

A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which
is the default configuration). OpenSSL TLS clients are not impacted by this
issue.
Vulnerability: GHSA-4qr3-m7ww-hh9g
Summary: Use After Free in rusqlite
Aliases: CVE-2021-45717
Severity: HIGH
CWE: CWE-416
Published: 2022-01-06T22:01:40Z

An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. commit_hook has a use-after-free.
Vulnerability: RUSTSEC-2021-0110
Summary: Multiple Vulnerabilities in Wasmtime
Aliases: CVE-2021-39219, CVE-2021-39216, CVE-2021-39218
Published: 2021-09-17T12:00:00Z

* [Use after free passing `externref`s to Wasm in
  Wasmtime](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-v4cp-h94r-m7xf)

* [Out-of-bounds read/write and invalid free with `externref`s and GC safepoints
  in
  Wasmtime](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4873-36h9-wv49)

* [Wrong type for `Linker`-define functions when used across two
  `Engine`s](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q879-9g95-56mx)
Vulnerability: GHSA-29v7-3v4c-gf38
Summary: Data races in parc
Aliases: CVE-2020-36454
Severity: HIGH
CWE: CWE-119, CWE-362
Published: 2021-08-25T20:57:24Z

An issue was discovered in the parc crate through 2020-11-14 for Rust. LockWeak<T> has an unconditional implementation of Send without trait bounds on T.
Vulnerability: RUSTSEC-2019-0034
Summary: HeaderMap::Drain API is unsound
Aliases: CVE-2019-25009
Published: 2019-11-16T12:00:00Z

Affected versions of this crate incorrectly used raw pointer,
which introduced unsoundness in its public safe API.

[Failing to drop the Drain struct causes double-free](https://github.com/hyperium/http/issues/354),
and [it is possible to violate Rust's alias rule and cause data race with Drain's Iterator implementation](https://github.com/hyperium/http/issues/355).

The flaw was corrected in 0.1.20 release of `http` crate.
Vulnerability: RUSTSEC-2020-0049
Summary: Use-after-free in Framed due to lack of pinning
Aliases: CVE-2020-35902
Published: 2020-01-30T12:00:00Z

Affected versions of this crate did not require the buffer wrapped in `Framed` to be pinned,
but treated it as if it had a fixed location in memory. This may result in a use-after-free.
 
The flaw was corrected by making the affected functions accept `Pin<&mut Self>` instead of `&mut self`.
Vulnerability: RUSTSEC-2021-0002
Summary: interfaces2 is unmaintained, use interfaces instead
Published: 2021-01-04T12:00:00Z

The `interfaces2` crate is not maintained any more;
use [`interfaces`](https://crates.io/crates/interfaces) instead.
Vulnerability: RUSTSEC-2020-0032
Summary: StrcCtx deallocates a memory region that it doesn't own
Aliases: CVE-2020-35885
Published: 2020-08-20T12:00:00Z

`StrcCtx` deallocate a memory region that it doesn't own when `StrcCtx` is created without using `StrcCtx::new`.
This can introduce memory safety issues such as double-free and use-after-free to client programs.
Vulnerability: GHSA-r88h-6987-g79f
Summary: Data races on syncpool
Severity: MODERATE
CWE: CWE-362
Published: 2021-08-25T21:00:28Z

Affected versions of this crate unconditionally implements `Send` for `Bucket2`. This allows sending non-Send types to other threads.

This can lead to data races when non Send types like `Cell<T>` or `Rc<T>` are contained inside `Bucket2` and sent across thread boundaries. The data races can potentially lead to memory corruption (as demonstrated in the PoC from the original report issue).

The flaw was corrected in commit 15b2828 by adding a `T: Send` bound to the `Send` impl of `Bucket2<T>`.
Vulnerability: GHSA-fvhr-7j8m-3cvc
Summary: Data races in appendix
Aliases: CVE-2020-36469
Severity: MODERATE
CWE: CWE-362
Published: 2021-08-25T20:57:02Z

The `appendix` crate implements a key-value mapping data structure called
`Index<K, V>` that is stored on disk. The crate allows for any type to inhabit
the generic `K` and `V` type parameters and implements Send and Sync for them
unconditionally.

Using a type that is not marked as `Send` or `Sync` with `Index` can allow it
to be used across multiple threads leading to data races. Additionally using
reference types for the keys or values will lead to the segmentation faults
in the crate's code.
Vulnerability: GHSA-cw4j-cf6c-mmfv
Summary: Use of Uninitialized Resource in binjs_io.
Aliases: CVE-2021-45683
Severity: CRITICAL
CWE: CWE-908
Published: 2022-01-06T22:14:24Z

An issue was discovered in the binjs_io crate through 2021-01-03 for Rust. The Read method may read from uninitialized memory locations.
Vulnerability: RUSTSEC-2021-0096
Summary: spirv_headers is unmaintained, use spirv instead
Published: 2021-08-16T12:00:00Z

Because of versioning issues; the `spirv_headers` crate is unmaintained. Use [spirv](https://crates.io/crates/spirv)
for parsing spirv files.
Vulnerability: RUSTSEC-2021-0079
Summary: Integer overflow in `hyper`'s parsing of the `Transfer-Encoding` header leads to data loss
Aliases: CVE-2021-32714, GHSA-5h46-h7hh-c6x9
Published: 2021-07-07T12:00:00Z

When decoding chunk sizes that are too large, `hyper`'s code would encounter an integer overflow. Depending on the situation,
this could lead to data loss from an incorrect total size, or in rarer cases, a request smuggling attack.

To be vulnerable, you must be using `hyper` for any HTTP/1 purpose, including as a client or server, and consumers must send
requests or responses that specify a chunk size greater than 18 exabytes. For a possible request smuggling attack to be possible,
any upstream proxies must accept a chunk size greater than 64 bits.
Vulnerability: RUSTSEC-2018-0004
Summary: Malicious input could cause uninitialized memory to be exposed
Aliases: CVE-2018-20992
Published: 2018-08-25T12:00:00Z

Affected versions of Claxon made an invalid assumption about the decode buffer
size being a multiple of a value read from the bitstream. This could cause parts
of the decode buffer to not be overwritten. If the decode buffer was newly
allocated and uninitialized, this uninitialized memory could be exposed.

This allows an attacker to observe parts of the uninitialized memory in the
decoded audio stream.

The flaw was corrected by checking that the value read from the bitstream divides
the decode buffer size, and returning a format error if it does not. If an error
is returned, the decode buffer is not exposed. Regression tests and an
additional fuzzer have been added to prevent similar flaws in the future.
Vulnerability: GHSA-hr3c-6mmp-6m39
Summary: Memory corruption slice-deque
Aliases: CVE-2018-20995
Severity: CRITICAL
CWE: CWE-119
Published: 2021-08-25T20:42:57Z

An issue was discovered in the slice-deque crate before 0.1.16 for Rust. move_head_unchecked allows memory corruption because deque updates are mishandled.
Vulnerability: GHSA-m8h8-v6jh-c762
Summary: Incorrect buffer size in crossbeam-channel
Aliases: CVE-2020-35904
Severity: MODERATE
CWE: CWE-131
Published: 2021-08-25T20:49:43Z

An issue was discovered in the crossbeam-channel crate before 0.4.4 for Rust. It has incorrect expectations about the relationship between the memory allocation and how many iterator elements there are.
Vulnerability: RUSTSEC-2020-0065
Summary: crate has been renamed to `sn_fake_clock`
Published: 2020-11-02T12:00:00Z

This crate has been renamed from `fake_clock` to `sn_fake_clock`.

The new repository location is:

<https://github.com/maidsafe/sn_fake_clock>
Vulnerability: RUSTSEC-2019-0018
Summary: Internally mutating methods take immutable ref self
Aliases: CVE-2019-16142
Published: 2019-09-02T12:00:00Z

Affected versions of this crate exposed several methods which took `self` by
immutable reference, despite the requesting the RenderDoc API to set a mutable
value internally.

This is technically unsound and calling these methods from multiple threads
without synchronization could lead to unexpected and unpredictable behavior.

The flaw was corrected in release 0.5.0.
Vulnerability: RUSTSEC-2020-0120
Summary: `Decoder<R>` can carry `R: !Send` to other threads
Aliases: CVE-2020-36440
Published: 2020-11-10T12:00:00Z

Affected versions of this crate implements `Send` for `Decoder<R>` for any `R: Read`. This allows `Decoder<R>` to contain `R: !Send` and carry (move) it to another thread.

This can result in undefined behavior such as memory corruption from data race on `R`, or dropping `R = MutexGuard<_>` from a thread that didn't lock the mutex.

The flaw was corrected in commit a34d6e1 by adding trait bound `R: Send` to the `Send` impl for `Decoder<R>`.
Vulnerability: GHSA-4wj3-p7hj-cvx8
Summary: Double free in ordnung
Aliases: CVE-2020-35891
Severity: HIGH
CWE: CWE-415
Published: 2021-08-25T20:48:47Z

An issue was discovered in the ordnung crate through 2020-09-03 for Rust. compact::Vec violates memory safety via a remove() double free.
Vulnerability: RUSTSEC-2020-0073
Summary: Mutable reference with immutable provenance
Aliases: CVE-2020-35916
Published: 2020-11-12T12:00:00Z

A mutable reference to a struct was constructed by dereferencing a pointer
obtained from `slice::as_ptr`. Instead, `slice::as_mut_ptr` should have been
called on the mutable slice argument. The former performs an implicit reborrow
as an immutable shared reference which does not allow writing through the
derived pointer.

There is no evidence for miscompilation, exploitable or otherwise, caused by
this bug. [Further investigation on Zulip][Zulip] suggests that the unoptimized
generated LLVM IR does not contain any UB itself, effectively mitigating
further effects.

[Zulip]: https://rust-lang.zulipchat.com/#narrow/stream/146229-wg-secure-code/topic/Implications.20of.20using.20.60slice.3A.3Aas_ptr.60.20for.20mutable.20access/near/216499472
Vulnerability: GHSA-92cx-4xm7-jr9m
Summary: Use After Free in rusqlite
Aliases: CVE-2021-45713
Severity: HIGH
CWE: CWE-416
Published: 2022-01-06T22:02:56Z

An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_scalar_function has a use-after-free.
Vulnerability: GHSA-39xg-8p43-h76x
Summary: Data races in reffers
Aliases: CVE-2020-36203
Severity: MODERATE
CWE: CWE-787, CWE-362
Published: 2021-08-25T20:51:40Z

An issue was discovered in the reffers crate through 2020-12-01 for Rust. ARefss can contain a !Send,!Sync object, leading to a data race and memory corruption.
Vulnerability: RUSTSEC-2020-0136
Summary: CopyCell lacks bounds on its Send trait allowing for data races
Aliases: CVE-2020-36456
Published: 2020-11-15T12:00:00Z

`CopyCell<T>` is a `Cell`-like type that is implemented for any type `T` that
is `Copy`able. It's `Send` trait has no bounds on the contained type.

As not all `Copy`able types are thread safe, for example non-mutable references
implement the `Copy` trait, it is possible to send references to types with
interior mutability such as `Cell` across threads and cause data races.
Vulnerability: GHSA-h3qr-rq2j-74w4
Summary: HTTP Request Smuggling in hyper
Aliases: CVE-2020-35863
Severity: CRITICAL
CWE: CWE-444
Published: 2021-08-25T20:46:08Z

An issue was discovered in the hyper crate before 0.12.34 for Rust. HTTP request smuggling can occur. Remote code execution can occur in certain situations with an HTTP server on the loopback interface.
Vulnerability: GHSA-v362-2895-h9r2
Summary: Use After Free in lru
Aliases: CVE-2021-45720
Severity: HIGH
CWE: CWE-416
Published: 2022-01-07T22:37:01Z

An issue was discovered in the lru crate before 0.7.1 for Rust. The iterators have a use-after-free, as demonstrated by an access after a pop operation.
Vulnerability: RUSTSEC-2021-0038
Summary: Multiple memory safety issues
Aliases: CVE-2021-28306, CVE-2021-28308, CVE-2021-28307
Published: 2021-03-06T12:00:00Z

Affected versions contain multiple memory safety issues, such as:

 - Setting a multi label type where an image doesn't exist would lead to a NULL pointer dereference.
 - Setting a window icon using a non-raster image (which FLTK rasterizes lazily) would lead to a NULL dereference.
 - Pixmap constructor would not check for correct pixmaps which could lead to out-of bound reads.
Vulnerability: GHSA-28ph-f7gx-fqj8
Summary: Data races in rusqlite
Aliases: CVE-2020-35867
Severity: CRITICAL
CWE: CWE-362
Published: 2021-08-25T20:47:57Z

An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via create_module.
Vulnerability: RUSTSEC-2020-0024
Summary: Improper uniqueness verification of signature threshold
Aliases: CVE-2020-15093, GHSA-5q2r-92f9-4m49
Published: 2020-07-09T12:00:00Z

The tough library, prior to 0.7.1, does not properly verify the uniqueness of
keys in the signatures provided to meet the threshold of cryptographic
signatures. It allows someone with access to a valid signing key to create
multiple valid signatures in order to circumvent TUF requiring a minimum
threshold of unique keys before the metadata is considered valid.

AWS would like to thank Erick Tryzelaar of the Google Fuchsia Team for
reporting this issue.

A fix is available in version 0.7.1.

CVE-2020-6174 is assigned to the same issue in the TUF reference
implementation.

If you have any questions or comments about this advisory, contact AWS Security
at aws-security@amazon.com.
Vulnerability: GHSA-r98r-j25q-rmpr
Summary: Type confusion in failure
Aliases: CVE-2019-25010
Severity: CRITICAL
CWE: CWE-843
Published: 2021-08-25T20:46:38Z

An issue was discovered in the failure crate through 2019-11-13 for Rust. Type confusion can occur when __private_get_type_id__ is overridden.
Vulnerability: RUSTSEC-2020-0161
Summary: `array!` macro is unsound in presence of traits that implement methods it calls internally
Published: 2020-05-07T12:00:00Z

Affected versions of this crate called some methods using auto-ref. The affected code looked like this.

```rust
let mut arr = $crate::__core::mem::MaybeUninit::uninit();
let mut vec = $crate::__ArrayVec::<T>::new(arr.as_mut_ptr() as *mut T);
```

In this case, the problem is that `as_mut_ptr` is a method of `&mut MaybeUninit`, not `MaybeUninit`. This made it possible for traits to hijack the method calls in order to cause unsoundness.

```rust
trait AsMutPtr<T> {
    fn as_mut_ptr(&self) -> *mut T;
}
impl<T> AsMutPtr<T> for std::mem::MaybeUninit<T> {
    fn as_mut_ptr(&self) -> *mut T {
        std::ptr::null_mut()
    }
}
array![0; 1];
```

The flaw was corrected by explicitly referencing variables in macro body in order to avoid auto-ref.
Vulnerability: GHSA-w3g5-2848-2v8r
Summary: Data races in generator
Aliases: CVE-2020-36471
Severity: MODERATE
CWE: CWE-362
Published: 2021-08-25T20:57:05Z

The `Generator` type is an iterable which uses a generator function that yields
values. In affected versions of the crate, the provided function yielding values
had no `Send` bounds despite the `Generator` itself implementing `Send`.

The generator function lacking a `Send` bound means that types that are
dangerous to send across threads such as `Rc` could be sent as part of a
generator, potentially leading to data races.

This flaw was fixed in commit [`f7d120a3b`](https://github.com/Xudong-Huang/generator-rs/commit/f7d120a3b724d06a7b623d0a4306acf8f78cb4f0)
by enforcing that the generator function be bound by `Send`.
Vulnerability: RUSTSEC-2021-0080
Summary: Links in archive can create arbitrary directories
Aliases: CVE-2021-38511
Published: 2021-07-19T12:00:00Z

When unpacking a tarball that contains a symlink the `tar` crate may create
directories outside of the directory it's supposed to unpack into.

The function errors when it's trying to create a file, but the folders are
already created at this point.

```rust
use std::{io, io::Result};
use tar::{Archive, Builder, EntryType, Header};

fn main() -> Result<()> {
    let mut buf = Vec::new();

    {
        let mut builder = Builder::new(&mut buf);

        // symlink: parent -> ..
        let mut header = Header::new_gnu();
        header.set_path("symlink")?;
        header.set_link_name("..")?;
        header.set_entry_type(EntryType::Symlink);
        header.set_size(0);
        header.set_cksum();
        builder.append(&header, io::empty())?;

        // file: symlink/exploit/foo/bar
        let mut header = Header::new_gnu();
        header.set_path("symlink/exploit/foo/bar")?;
        header.set_size(0);
        header.set_cksum();
        builder.append(&header, io::empty())?;

        builder.finish()?;
    };

    Archive::new(&*buf).unpack("demo")
}
```

This has been fixed in https://github.com/alexcrichton/tar-rs/pull/259 and is
published as `tar` 0.4.36. Thanks to Martin Michaelis (@mgjm) for discovering
and reporting this, and Nikhil Benesch (@benesch) for the fix!
Vulnerability: GHSA-2grh-hm3w-w7hv
Summary: Race condition in tokio
Aliases: CVE-2021-38191
Severity: MODERATE
CWE: CWE-366, CWE-362
Published: 2021-08-25T20:55:51Z

An issue was discovered in the tokio crate before 1.8.1 for Rust. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread.
Vulnerability: RUSTSEC-2018-0012
Summary: Flaw in streaming state reset() functions can create incorrect results.
Aliases: CVE-2018-20999
Published: 2018-12-20T12:00:00Z

Affected versions of this crate did not properly reset a streaming state.

Resetting a streaming state, without finalising it first, creates incorrect results.
 
The flaw was corrected by not first checking if the state had already been reset, when calling reset().
Vulnerability: RUSTSEC-2019-0021
Summary: `Matrix::zip_elements` causes double free
Aliases: CVE-2019-16880
Published: 2019-09-14T12:00:00Z

Affected versions of this crate did not properly implements the `Matrix::zip_elements` method, which causes an double free when the given trait implementation might panic.

This allows an attacker to corrupt or take control of the memory.
 
The flaw was corrected by Phosphorus15.
Vulnerability: GHSA-2gxj-qrp2-53jv
Summary: Incorrect reliance on Trait memory layout in mopa
Aliases: CVE-2021-45695
Severity: CRITICAL
Published: 2022-01-06T22:11:11Z

An issue was discovered in the mopa crate through 2021-06-01 for Rust. It incorrectly relies on Trait memory layout, possibly leading to future occurrences of arbitrary code execution or ASLR bypass.
Vulnerability: GHSA-pwhf-7427-9vv2
Summary: Non-atomic writes in cgc
Aliases: CVE-2020-36468
Severity: MODERATE
CWE: CWE-657
Published: 2021-08-25T20:56:57Z

An issue was discovered in the cgc crate through 2020-12-10 for Rust. Ptr::write performs non-atomic write operations on an underlying pointer.
Vulnerability: RUSTSEC-2020-0119
Summary: ReadTicket and WriteTicket should only be sendable when T is Send
Aliases: CVE-2020-36439
Published: 2020-11-17T12:00:00Z

Affected versions of this crate unconditionally implemented `Send` for `ReadTicket<T>` & `WriteTicket<T>`.
This allows to send non-Send `T` to other threads.

This can allows creating data races by cloning types with internal mutability and sending them to other threads (as `T` of `ReadTicket<T>`/`WriteTicket<T>`). Such data races can cause memory corruption or other undefined behavior.

The flaw was corrected in commit a986a93 by adding `T: Send` bounds to `Send` impls of `ReadTicket<T>`/`WriteTicket<T>`.
Vulnerability: GHSA-mm4m-qg48-f7wc
Summary: Improper Synchronization and Race Condition in vm-memory
Aliases: CVE-2020-13759
Severity: HIGH
CWE: CWE-662, CWE-362
Published: 2021-08-25T21:01:29Z

rust-vmm vm-memory before 0.1.1 and 0.2.x before 0.2.1 allows attackers to cause a denial of service (loss of IP networking) because read_obj and write_obj do not properly access memory. This affects aarch64 (with musl or glibc) and x86_64 (with musl).
Vulnerability: GHSA-jv2r-jx6q-89jg
Summary: Use of Uninitialized Resource in bronzedb-protocol.
Aliases: CVE-2021-45682
Severity: CRITICAL
CWE: CWE-908
Published: 2022-01-06T22:16:32Z

An issue was discovered in the bronzedb-protocol crate through 2021-01-03 for Rust. ReadKVExt may read from uninitialized memory locations.
Vulnerability: GHSA-566x-hhrf-qf8m
Summary: Use after free in ordered-float
Aliases: CVE-2020-35923
Severity: MODERATE
CWE: CWE-416
Published: 2021-08-25T20:50:30Z

An issue was discovered in the ordered-float crate before 1.1.1 and 2.x before 2.0.1 for Rust. A NotNan value can contain a NaN.
Vulnerability: GHSA-29hg-r7c7-54fr
Summary: Double free in insert_many
Aliases: CVE-2021-29933
Severity: HIGH
CWE: CWE-415
Published: 2021-08-25T20:55:06Z

An issue was discovered in the insert_many crate through 2021-01-26 for Rust. Elements may be dropped twice if a .next() method panics.
Vulnerability: GHSA-w9r2-qrpm-4rmj
Summary: Data race in disrustor
Aliases: CVE-2020-36470
Severity: MODERATE
CWE: CWE-362
Published: 2021-08-25T20:56:59Z

An issue was discovered in the disrustor crate through 2020-12-17 for Rust. RingBuffer doe not properly limit the number of mutable references.
Vulnerability: RUSTSEC-2021-0017
Summary: `Read` on uninitialized buffer may cause UB (`impl Walue for Vec<u8>`)
Aliases: CVE-2021-26953
Published: 2021-01-30T12:00:00Z

Affected versions of this crate passes an uninitialized buffer to a user-provided `Read` implementation.

Arbitrary `Read` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer.
Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.

This flaw was fixed in commit 8026286 by zero-initializing the buffer before handing to a user-provided `Read`.
Vulnerability: GHSA-hxjf-h2mh-r6hj
Summary: Use After Free in libpulse-binding
Aliases: CVE-2018-25027
Severity: HIGH
CWE: CWE-416
Published: 2022-01-06T22:20:12Z

An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust. get_format_info can cause a use-after-free.
Vulnerability: RUSTSEC-2021-0105
Summary: Relative Path Traversal in git-delta
Aliases: CVE-2021-36376, GHSA-5xg3-j2j6-rcx4
Published: 2021-07-12T12:00:00Z

git-delta before 0.8.3 on Windows resolves an executable's pathname as a relative path from the current directory.
Vulnerability: GHSA-qxjq-v4wf-ppvh
Summary: Out of bounds read in dync
Aliases: CVE-2020-35903
Severity: MODERATE
CWE: CWE-125
Published: 2021-08-25T20:49:47Z

An issue was discovered in the dync crate before 0.5.0 for Rust. VecCopy allows misaligned element access because u8 is not always the type in question.
Vulnerability: GHSA-9hfg-pxr6-q4vp
Summary: Use of a Broken or Risky Cryptographic Algorithm in crypto2
Aliases: CVE-2021-45709
Severity: CRITICAL
CWE: CWE-327
Published: 2022-01-06T22:04:51Z

An issue was discovered in the crypto2 crate through 2021-10-08 for Rust. During Chacha20 encryption and decryption, an unaligned read of a u32 may occur.
Vulnerability: RUSTSEC-2021-0040
Summary: panic safety: double drop or uninitialized drop of T upon panic
Aliases: CVE-2021-29931, CVE-2021-29930
Published: 2021-01-12T12:00:00Z

Affected versions of this crate did not guard against potential panics that may happen from user-provided functions `T::default()` and `T::drop()`.

Panic within `T::default()` leads to dropping uninitialized `T`, when it is invoked from `common::Slice::<T, H>::new()`.
Panic within `T::drop()` leads to double drop of `T`, when it is invoked either from `common::SliceVec::<T, H>::resize_with()` or `common::SliceVec::<T, H>::resize()`

Either case causes memory corruption in the heap memory.
Vulnerability: RUSTSEC-2022-0015
Summary: pty is unmaintained
Published: 2022-03-22T12:00:00Z

The repository hasn't received any updates since Jun 25, 2017 and the author is unresponsive.

Maintained alternatives include:

* [`tokio-pty-process`](https://crates.io/crates/tokio-pty-process)
* [`pty-process`](https://crates.io/crates/pty-process)
Vulnerability: GHSA-hrjm-c879-pp86
Summary: Side-channel timing attack in libsecp256k1
Aliases: CVE-2019-25003
Severity: HIGH
CWE: CWE-208
Published: 2021-08-25T20:46:46Z

An issue was discovered in the libsecp256k1 crate before 0.3.1 for Rust. Scalar::check_overflow allows a timing side-channel attack; consequently, attackers can obtain sensitive information.
Vulnerability: GHSA-84rm-qf37-fgc2
Summary: Integer Overflow in openssl-src
Aliases: CVE-2021-23841
Severity: MODERATE
CWE: CWE-190, CWE-476
Published: 2021-08-25T20:52:21Z

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).
Vulnerability: GHSA-rjh8-p66p-jrh5
Summary: Data races in rusqlite
Aliases: CVE-2020-35871
Severity: HIGH
CWE: CWE-362
Published: 2021-08-25T20:46:59Z

An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API data race.
Vulnerability: RUSTSEC-2020-0158
Summary: slice-deque is unmaintained
Published: 2020-02-10T12:00:00Z

The author of the `slice-deque` crate is unresponsive and is not receiving security patches.

Maintained alternatives:

- [`slice-ring-buffer`](https://crates.io/crates/slice-ring-buffer)
Vulnerability: RUSTSEC-2021-0113
Summary: AtomicBucket<T> unconditionally implements Send/Sync
Published: 2021-04-07T12:00:00Z

In the affected versions of the crate, `AtomicBucket<T>` unconditionally implements `Send`/`Sync` traits. Therefore, users can create a data race to the inner
`T: !Sync` by using the `AtomicBucket::data_with()` API.
Such data races can potentially cause memory corruption or other undefined behavior.

The flaw was fixed in commit 8e6daab by adding appropriate Send/Sync bounds to the Send/Sync impl of struct `Block<T>` (which is a data type contained inside `AtomicBucket<T>`).
Vulnerability: RUSTSEC-2022-0003
Summary: Space bug in `clean_text`
Published: 2022-01-19T12:00:00Z

An incorrect mapping from HTML specification to ASCII codes was used.
Because HTML treats the Form Feed as whitespace, code like this has an injection bug:

    let html = format!("<div title={}>", clean_text(user_supplied_string));

Applications are not affected if they quote their attributes, or if they don't use `clean_text` at all.
Vulnerability: RUSTSEC-2021-0056
Summary: CA certificate check bypass with X509_V_FLAG_X509_STRICT
Aliases: CVE-2021-3450
Published: 2021-05-01T12:00:00Z

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the
certificates present in a certificate chain. It is not set by default.

Starting from OpenSSL version 1.1.1h a check to disallow certificates in
the chain that have explicitly encoded elliptic curve parameters was added
as an additional strict check.

An error in the implementation of this check meant that the result of a
previous check to confirm that certificates in the chain are valid CA
certificates was overwritten. This effectively bypasses the check
that non-CA certificates must not be able to issue other certificates.

If a "purpose" has been configured then there is a subsequent opportunity
for checks that the certificate is a valid CA.  All of the named "purpose"
values implemented in libcrypto perform this check.  Therefore, where
a purpose is set the certificate chain will still be rejected even when the
strict flag has been used. A purpose is set by default in libssl client and
server certificate verification routines, but it can be overridden or
removed by an application.

In order to be affected, an application must explicitly set the
X509_V_FLAG_X509_STRICT verification flag and either not set a purpose
for the certificate verification or, in the case of TLS client or server
applications, override the default purpose.
Vulnerability: GHSA-2367-c296-3mp2
Summary: Link following in tar
Aliases: CVE-2018-20990
Severity: HIGH
CWE: CWE-59
Published: 2021-08-25T20:43:54Z

An issue was discovered in the tar crate before 0.4.16 for Rust. Arbitrary file overwrite can occur via a symlink or hardlink in a TAR archive.
Vulnerability: GHSA-j2r6-2m5c-vgh5
Summary: Counter overflow in chacha20
Aliases: CVE-2019-25005
Severity: HIGH
CWE: CWE-190
Published: 2021-08-25T20:45:20Z

An issue was discovered in the chacha20 crate before 0.2.3 for Rust. A ChaCha20 counter overflow makes it easier for attackers to determine plaintext.
Vulnerability: RUSTSEC-2019-0037
Summary: Compiler optimisation for next_with_timeout in pnet::transport::IcmpTransportChannelIterator flaws to SEGFAULT
Published: 2019-06-11T12:00:00Z

Affected versions of this crate were optimized out by compiler,
which caused dereference of uninitialized file descriptor which caused segfault.
Vulnerability: GHSA-wcxc-jf6c-8rx9
Summary:  Uncaught Exception in libpulse-binding
Severity: MODERATE
CWE: CWE-248
Published: 2021-08-25T20:57:21Z

Affected versions of this crate failed to catch panics crossing FFI boundaries via callbacks, which
is a form of UB. This flaw was corrected by [this commit][1] which was included in version 2.6.0.
Vulnerability: GHSA-xjxc-vfw2-cg96
Summary: Use after free in openssl
Aliases: CVE-2018-20997
Severity: CRITICAL
CWE: CWE-416
Published: 2021-08-25T20:43:45Z

An issue was discovered in the openssl crate before 0.10.9 for Rust. A use-after-free occurs in CMS Signing.
Vulnerability: GHSA-p4cr-64x4-f92f
Summary: Use of Uninitialized Resource in acc_reader.
Aliases: CVE-2020-36514
Severity: CRITICAL
CWE: CWE-908
Published: 2022-01-06T22:17:23Z

An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. fill_buf may read from uninitialized memory locations.
Vulnerability: GHSA-6c65-xcf5-299x
Summary: Uninitialized memory use in generator
Aliases: CVE-2019-16144
Severity: HIGH
CWE: CWE-908
Published: 2021-08-25T20:58:25Z

An issue was discovered in the generator crate before 0.6.18 for Rust. Uninitialized memory is used by Scope, done, and yield_ during API calls.
Vulnerability: RUSTSEC-2021-0001
Summary: XSS in mdBook's search page
Aliases: CVE-2020-26297
Published: 2021-01-04T12:00:00Z

> This is a cross-post of [the official security advisory][ml]. The official post
> contains a signed version with our PGP key, as well.

[ml]: https://groups.google.com/g/rustlang-security-announcements/c/3-sO6of29O0

The Rust Security Response Working Group was recently notified of a security
issue affecting the search feature of mdBook, which could allow an attacker to
execute arbitrary JavaScript code on the page.

The CVE for this vulnerability is [CVE-2020-26297][1].

## Overview

The search feature of mdBook (introduced in version 0.1.4) was affected by a
cross site scripting vulnerability that allowed an attacker to execute
arbitrary JavaScript code on an user's browser by tricking the user into typing
a malicious search query, or tricking the user into clicking a link to the
search page with the malicious search query prefilled.

mdBook 0.4.5 fixes the vulnerability by properly escaping the search query.

## Mitigations

Owners of websites built with mdBook have to upgrade to mdBook 0.4.5 or greater
and rebuild their website contents with it. It's possible to install mdBook
0.4.5 on the local system with:

```
cargo install mdbook --version 0.4.5 --force
```

## Acknowledgements

Thanks to Kamil Vavra for responsibly disclosing the vulnerability to us
according to [our security policy][2].

## Timeline of events

All times are listed in UTC.

* 2020-12-30 20:14 - The issue is reported to the Rust Security Response WG
* 2020-12-30 20:32 - The issue is acknowledged and the investigation began
* 2020-12-30 21:21 - Found the cause of the vulnerability and prepared the patch
* 2021-01-04 15:00 - Patched version released and vulnerability disclosed

[1]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26297
[2]: https://www.rust-lang.org/policies/security
Vulnerability: GHSA-8928-2fgm-6x9x
Summary: HTTP Request Smuggling in actix-http
Aliases: CVE-2021-38512
Severity: HIGH
CWE: CWE-444
Published: 2021-08-25T20:58:21Z

Affected versions of this crate did not properly detect invalid requests that could allow HTTP/1 request smuggling (HRS) attacks when running alongside a vulnerable front-end proxy server. This can result in leaked internal and/or user data, including credentials, when the front-end proxy is also vulnerable.

Popular front-end proxies and load balancers already mitigate HRS attacks so it is recommended that they are also kept up to date; check your specific set up. You should upgrade even if the front-end proxy receives exclusively HTTP/2 traffic and connects to the back-end using HTTP/1; several downgrade attacks are known that can also expose HRS vulnerabilities.
Vulnerability: GHSA-r6ff-2q3c-v3pv
Summary: Compiler optimisation leads to SEGFAULT
Severity: MODERATE
CWE: CWE-908
Published: 2021-08-25T21:00:01Z

Affected versions of the `pnet` crate were optimized out by compiler, which caused dereference of uninitialized file descriptor which caused segfault.
Vulnerability: GHSA-hw4v-5x4h-c3xm
Summary: Transaction validity oversight in pallet-ethereum
Aliases: CVE-2021-39193
Severity: MODERATE
CWE: CWE-20
Published: 2021-09-01T18:22:48Z

### Impact

A bug in `pallet-ethereum` can cause invalid transactions to be included in the Ethereum block state in `pallet-ethereum` due to not validating the input data size. Any invalid transactions included this way have no possibility to alter the internal Ethereum or Substrate state. The transaction will appear to have be included, but is of no effect as it is rejected by the EVM engine. The impact is further limited by Substrate extrinsic size constraints.

### Patches

Patches are applied in PR #465.

### Workarounds

None.

### References

Patch PR: https://github.com/paritytech/frontier/pull/465

### For more information

If you have any questions or comments about this advisory:
* Open an issue in the [Frontier repo](https://github.com/paritytech/frontier)
Vulnerability: RUSTSEC-2020-0031
Summary: HTTP Request smuggling through malformed Transfer Encoding headers
Aliases: CVE-2020-35884
Published: 2020-06-16T12:00:00Z

HTTP pipelining issues and request smuggling attacks are possible due to incorrect 
Transfer encoding header parsing.

It is possible conduct HTTP request smuggling attacks (CL:TE/TE:TE) by sending invalid Transfer Encoding headers. 

By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information 
from requests other than their own.
Vulnerability: GHSA-q2x5-6q7q-r872
Summary: Use After Free in tremor-script
Aliases: CVE-2021-45701
Severity: CRITICAL
CWE: CWE-416
Published: 2022-01-06T22:10:17Z

An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A patch operation may result in a use-after-free.
Vulnerability: RUSTSEC-2018-0007
Summary: Stack overflow when parsing malicious DNS packet
Aliases: CVE-2018-20994
Published: 2018-10-09T12:00:00Z

There's a stack overflow leading to a crash when Trust-DNS's parses a
malicious DNS packet.

Affected versions of this crate did not properly handle parsing of DNS message
compression (RFC1035 section 4.1.4). The parser could be tricked into infinite
loop when a compression offset pointed back to the same domain name to be
parsed.

This allows an attacker to craft a malicious DNS packet which when consumed
with Trust-DNS could cause stack overflow and crash the affected software.

The flaw was corrected by trust-dns-proto 0.4.3 and upcoming 0.5.0 release.
Vulnerability: RUSTSEC-2021-0095
Summary: `mopa` is technically unsound
Published: 2021-06-01T12:00:00Z

The `mopa` crate redefines the deprecated `TraitObject` struct from `core::raw` like so:
```rust
#[repr(C)]
#[derive(Copy, Clone)]
#[doc(hidden)]
pub struct TraitObject {
    pub data: *mut (),
    pub vtable: *mut (),
}
```
This is done to then transmute a reference to a trait object (`&dyn Trait` for any trait `Trait`) into this struct and retrieve the `data` field for the purpose of downcasting. This is used to implement `downcast_ref_unchecked()`, in terms of which `downcast_ref()` is also implemented. Same goes for mutable reference downcasting and `Box` downcasting.

The Rust compiler explicitly reserves the right to change the memory layout of `&dyn Trait` for any trait `Trait`. The worst case scenario is that it swaps `data` and `vtable`, making an executable location breach and compromisation of ASLR possible, since reads from `data` would read `vtable` instead. Likewise, arbitrary code execution is also theoretically possible if reads of `vtable` generated by the compiler read `data` instead.

While, as of Rust 1.52, this unsound assumption still holds true, updating the compiler may silently create UB in a crate which previously compiled and run without issues, compromising the security of builds which are believed to be reproducible.

A potential strategy to resolve this has already been suggested in an issue on the GitHub repository of the crate.
Vulnerability: RUSTSEC-2020-0123
Summary: Contents of uninitialized memory exposed in DeflateOutput's AsyncRead implementation
Aliases: CVE-2020-36443
Published: 2020-01-24T12:00:00Z

Affected versions of this crate passes an uninitialized buffer to a user-provided trait function `AsyncRead::poll_read()`.

Arbitrary `AsyncRead::poll_read()` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer.
Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.

The flaw was fixed in commit 5ba266a by ensuring the newly allocated part of the buffer is zero-initialized before passing it to a user-provided `AsyncRead::poll_read()`.
Vulnerability: GHSA-wcg3-cvx6-7396
Summary: Segmentation fault in time
Aliases: CVE-2020-26235
Severity: MODERATE
CWE: CWE-476
Published: 2021-08-25T20:56:46Z

### Impact

Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.

The affected functions from time 0.2.7 through 0.2.22 are:

- `time::UtcOffset::local_offset_at`
- `time::UtcOffset::try_local_offset_at`
- `time::UtcOffset::current_local_offset`
- `time::UtcOffset::try_current_local_offset`
- `time::OffsetDateTime::now_local`
- `time::OffsetDateTime::try_now_local`

The affected functions in time 0.1 (all versions) are:

- `at`
- `at_utc`
- `now`

Non-Unix targets (including Windows and wasm) are unaffected.

### Patches

Pending a proper fix, the internal method that determines the local offset has been modified to always return `None` on the affected operating systems. This has the effect of returning an `Err` on the `try_*` methods and `UTC` on the non-`try_*` methods.

Users and library authors with time in their dependency tree should perform `cargo update`, which will pull in the updated, unaffected code.

Users of time 0.1 do not have a patch and should upgrade to an unaffected version: time 0.2.23 or greater or the 0.3. series.

### Workarounds

No workarounds are known.

### References

time-rs/time#293
Vulnerability: RUSTSEC-2020-0089
Summary: nanorand 0.5.0 - RNGs failed to generate properly for non-64-bit numbers
Aliases: CVE-2020-35926
Published: 2020-12-09T12:00:00Z

In versions of `nanorand` prior to 0.5.1, `RandomGen` implementations for standard unsigned integers could
fail to properly generate numbers, due to using bit-shifting to truncate a 64-bit number, rather than just
an `as` conversion.

This often manifested as RNGs returning nothing but 0, including the cryptographically secure `ChaCha` random
number generator..
Vulnerability: RUSTSEC-2020-0066
Summary: crate has been renamed to `sn_bindgen`
Published: 2020-11-02T12:00:00Z

This crate has been renamed from `safe_bindgen` to `sn_bindgen`.

The new repository location is:

<https://github.com/maidsafe/sn_bindgen>