TQRG/raw-osv-data huggingface dataset:
Vulnerability: RUSTSEC-2020-0061
Summary: futures_task::noop_waker_ref can segfault due to dereferencing a NULL pointer
Aliases: CVE-2020-35907
Published: 2020-05-03T12:00:00Z

Affected versions of the crate used a `UnsafeCell` in thread-local storage to return a noop waker reference,
assuming that the reference would never be returned from another thread.

This resulted in a segmentation fault crash if `Waker::wake_by_ref()` was called on a waker returned from another thread due to 
it attempting to dereference a pointer that wasn't accessible from the main thread.

Reproduction Example (from issue):
```rust
use futures_task::noop_waker_ref;
fn main() {
    let waker = std::thread::spawn(|| noop_waker_ref()).join().unwrap();
    waker.wake_by_ref();
}
```

The flaw was corrected by using a `OnceCell::Lazy<>` wrapper around the noop waker instead of thread-local storage.
Vulnerability: GHSA-69vj-xx27-g45w
Summary: Data race in eventio
Aliases: CVE-2020-36216
Severity: MODERATE
CWE: CWE-662, CWE-787
Published: 2021-08-25T20:51:49Z

An issue was discovered in Input<R> in the eventio crate before 0.5.1 for Rust. Because a non-Send type can be sent to a different thread, a data race and memory corruption can occur.
Vulnerability: RUSTSEC-2021-0092
Summary: Deserialization functions pass uninitialized memory to user-provided Read
Published: 2021-01-26T12:00:00Z

Affected versions of this crate passed an uninitialized buffer to a
user-provided `Read` instance in:

* `deserialize_binary`
* `deserialize_string`
* `deserialize_extension_others`
* `deserialize_string_primitive`

This can result in safe `Read` implementations reading from the uninitialized
buffer leading to undefined behavior.
Vulnerability: GHSA-v935-pqmr-g8v9
Summary: Unexpected panics in num-bigint
Severity: MODERATE
CWE: CWE-131, CWE-20
Published: 2021-11-03T17:36:04Z

### Impact

Two scenarios were reported where `BigInt` and `BigUint` multiplication may unexpectedly panic.

- The internal `mac3` function did not expect the possibility of non-empty all-zero inputs, leading to an `unwrap()` panic.
- A buffer was allocated with less capacity than needed for an intermediate result, leading to an assertion panic.

Rust panics can either cause stack unwinding or program abort, depending on the application configuration. In some settings, an unexpected panic may constitute a denial-of-service vulnerability.

### Patches
Both problems were introduced in version 0.4.1, and are fixed in version 0.4.3.

### For more information
If you have any questions or comments about this advisory, please open an issue in the [num-bigint](https://github.com/rust-num/num-bigint) repo.

### Acknowledgements
Thanks to Guido Vranken and Arvid Norberg for privately reporting these issues to the author.

### References
* [GHSA-v935-pqmr-g8v9](https://github.com/rust-num/num-bigint/security/advisories/GHSA-v935-pqmr-g8v9)
* [num-bigint#228](https://github.com/rust-num/num-bigint/pull/228)
Vulnerability: RUSTSEC-2020-0036
Summary: failure is officially deprecated/unmaintained
Aliases: CVE-2020-25575
Published: 2020-05-02T12:00:00Z

The `failure` crate is officially end-of-life: it has been marked as deprecated
by the former maintainer, who has announced that there will be no updates or
maintenance work on it going forward.

The following are some suggested actively developed alternatives to switch to:

- [`anyhow`](https://crates.io/crates/anyhow)
- [`eyre`](https://crates.io/crates/eyre)
- [`fehler`](https://crates.io/crates/fehler)
- [`snafu`](https://crates.io/crates/snafu)
- [`thiserror`](https://crates.io/crates/thiserror)
Vulnerability: GHSA-x7vr-c387-8w57
Summary: Integer Overflow/Infinite Loop in the http crate
Aliases: CVE-2020-25574
Severity: HIGH
CWE: CWE-190, CWE-835
Published: 2021-08-25T21:01:31Z

An issue was discovered in the http crate before 0.1.20 for Rust. An integer overflow in HeaderMap::reserve() could result in denial of service (e.g., an infinite loop).
Vulnerability: GHSA-hxw9-jxqw-jc8j
Summary: Data races in dces
Aliases: CVE-2020-36459
Severity: HIGH
CWE: CWE-77, CWE-362
Published: 2021-08-25T20:58:05Z

An issue was discovered in the dces crate through 2020-12-09 for Rust. The World type is marked as Send but lacks bounds on its EntityStore and ComponentStore. This allows non-thread safe `EntityStore` and `ComponentStore`s to be sent
across threads and cause data races.
Vulnerability: RUSTSEC-2021-0006
Summary: Exposes internally used raw pointer
Aliases: CVE-2021-25903
Published: 2021-01-01T12:00:00Z

Affected versions of this crate dereference a raw pointer that can be modified
without using `unsafe` code.
Vulnerability: GHSA-9wgh-vjj7-7433
Summary: Mutable reference with immutable provenance in image
Aliases: CVE-2020-35916
Severity: MODERATE
CWE: CWE-400
Published: 2021-08-25T20:49:54Z

An issue was discovered in the image crate before 0.23.12 for Rust. A Mutable reference has immutable provenance. (In the case of LLVM, the IR may be always correct.)
Vulnerability: GHSA-w5cr-frph-hw7f
Summary: Use of uninitialized buffer in rkyv
Aliases: CVE-2021-31919
Severity: HIGH
CWE: CWE-908
Published: 2021-08-25T21:01:50Z

An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct.
Vulnerability: RUSTSEC-2019-0030
Summary: Incorrect implementation of the Streebog hash functions
Aliases: CVE-2019-25006, CVE-2019-25007, CVE-2020-25575
Published: 2019-10-06T12:00:00Z

Internal `update-sigma` function was implemented incorrectly and depending on
`debug-assertions` it could've caused an incorrect result or panic for certain
inputs.
Vulnerability: GHSA-5hp8-35wj-m525
Summary: Uncontrolled recursion in ammonia
Aliases: CVE-2019-15542
Severity: HIGH
CWE: CWE-674
Published: 2021-08-25T20:44:03Z

An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.
Vulnerability: GHSA-8m49-2xj8-67v9
Summary: Data Loss/Denial of Service in SWHKD
Aliases: CVE-2022-27816
Severity: HIGH
CWE: CWE-59
Published: 2022-03-31T00:00:24Z

SWHKD 1.1.5 unsafely uses the /tmp/swhks.pid pathname. There can be data loss or a denial of service. A patch is available on the `1.1.0` branch of the repository.
Vulnerability: RUSTSEC-2020-0108
Summary: Soundness issue: Input<R> can be misused to create data race to an object
Aliases: CVE-2020-36216
Published: 2020-12-20T12:00:00Z

`Input<R>` implements `Send` without requiring `R: Send`.

Affected versions of this crate allows users to send non-Send types to other threads,
which can lead to undefined behavior such as data race and memory corruption.

The flaw was corrected in version 0.5.1 by adding `R: Send` bound to the `Send` impl of `Input<R>`.
Vulnerability: RUSTSEC-2021-0114
Summary: Aliased mutable references from `tls_rand` & `TlsWyRand`
Published: 2021-09-23T12:00:00Z

`TlsWyRand`'s implementation of `Deref` unconditionally dereferences a raw pointer, and returns 
multiple mutable references to the same object, which is undefined behavior.
Vulnerability: GHSA-c8hq-x4mm-p6q6
Summary: Memory handling issues in xcb
Aliases: CVE-2020-36205
Severity: MODERATE
CWE: CWE-416, CWE-415
Published: 2021-08-25T20:50:54Z

An issue was discovered in the xcb crate through 2020-12-10 for Rust. base::Error does not have soundness. Because of the public ptr field, a use-after-free or double-free can occur.
Vulnerability: RUSTSEC-2021-0051
Summary: KeyValueReader passes uninitialized memory to Read instance
Aliases: CVE-2021-30454
Published: 2021-01-31T12:00:00Z

The `KeyValueReader` type in affected versions of this crate set up an
uninitialized memory buffer and passed them to be read in to a user-provided
`Read` instance.

The `Read` instance could read uninitialized memory and cause undefined
behavior and miscompilations.

This issue was fixed in commit [dd59b30](https://github.com/SolraBizna/outer_cgi/commit/dd59b3066e616a08e756f72de8dc3ab11b7036c4)
by zero-initializing the buffers before passing them.
Vulnerability: RUSTSEC-2022-0004
Summary: Stack overflow in rustc_serialize when parsing deeply nested JSON
Published: 2022-01-01T12:00:00Z

When parsing JSON using `json::Json::from_str`, there is no limit to the depth of the stack, therefore deeply nested objects can cause a stack overflow, which aborts the process.

Example code that triggers the vulnerability is

```rust
fn main() {
    let _ = rustc_serialize::json::Json::from_str(&"[0,[".repeat(10000));
}
```

[serde](https://crates.io/crates/serde) is recommended as a replacement to rustc_serialize.
Vulnerability: GHSA-xwqr-xmgg-j69q
Summary: Integer overflow in solana_rbpf
Aliases: CVE-2021-46102
Severity: HIGH
CWE: CWE-190
Published: 2022-01-28T22:59:28Z

From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs has an integer overflow bug because the sym.st_value is read directly from ELF file without checking. If the sym.st_value is rather large, an integer overflow is triggered while calculating the variable "addr" via "addr = (sym.st_value + refd_pa) as u64";
Vulnerability: GHSA-45w3-v3g4-54pm
Summary: Potential segfault in SPIFFE authenticator
Severity: LOW
CWE: CWE-476
Published: 2022-02-11T19:11:36Z

### Impact
Several vulnerabilities have been reported in the `time` and `chrono` crates related to handling of calls to `localtime_r`. You can follow some of the discussions [here](https://github.com/chronotope/chrono/issues/602) and [here](https://github.com/time-rs/time/issues/293), and the associated CVE [here](https://nvd.nist.gov/vuln/detail/CVE-2020-26235). In our case, the issue with the dependency was flagged by our nightly CI build running [`cargo-audit`](https://github.com/parallaxsecond/parsec/issues/544). 

The vulnerability leads to a segfault in specific circumstances - namely, when one of a number of functions in the `time` crate is called while any other thread is setting an environment variable. Given that in the case of the Parsec service this affects the SPIFFE authenticator, Parsec service users can encounter the issue only when the JWT SVID authenticator is enabled and being used. We have not undergone any manual tracing to understand if the vulnerable methods are called anywhere in our stack, however it seems reasonable to expect that if that were to be the case, the issue would lie in JWT validation (i.e. when handling the dates found within a Json Web Token). JWT validation could thus fail, bringing down the thread in which the request happens. The rest of the threads continue to work. Since the threadpool implementation that we use [continues replenishing the pool](https://docs.rs/threadpool/latest/threadpool/) when one thread panics, the impact on the service should be minimal.

### Patches
No current patches exist as the problems lie in a number of dependencies that are not under our control (see more details [here](https://github.com/parallaxsecond/parsec/issues/544#issuecomment-1024185688)).

The issue tracking the required change in the `rust-spiffe` crate (through which the vulnerable dependencies are imported in Parsec) can be seen [here](https://github.com/maxlambrecht/rust-spiffe/issues/17). Once updates happen in our dependency chain that allow us to update beyond the vulnerable versions of `time` and `chrono`, a new version of the Parsec service will be tagged and released with the appropriate notifications.

### Workarounds
The only complete workaround is to use a different type of authenticator with the Parsec service. 

### References
As quoted in the initial paragraph, you can find out more information:
* in the `chrono` repo issue [here](https://github.com/chronotope/chrono/issues/602)
* in the `time` repo issue [here](https://github.com/time-rs/time/issues/293)
* in the official CVE report [here](https://nvd.nist.gov/vuln/detail/CVE-2020-26235)
* in our tracking issue [here](https://github.com/parallaxsecond/parsec/issues/544)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the Parsec service repo](https://github.com/parallaxsecond/parsec)
* Email us at [cncf-parsec-maintainers@lists.cncf.io](mailto:cncf-parsec-maintainers@lists.cncf.io)
Vulnerability: RUSTSEC-2021-0102
Summary: Permissions bypass in pleaser
Aliases: CVE-2021-31154, GHSA-pp74-39w2-v4w9
Published: 2021-05-27T12:00:00Z

pleaseedit in pleaser before 0.4 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.
Vulnerability: RUSTSEC-2022-0012
Summary: Arrow2 allows double free in `safe` code
Published: 2022-03-04T12:00:00Z

The struct `Ffi_ArrowArray` implements `#derive(Clone)` that is inconsistent with
its custom implementation of `Drop`, resulting in a double free when cloned.

Cloning this struct in `safe` results in a segmentation fault, which is unsound.

This derive was removed from this struct. All users are advised to either:
* bump the patch version of this crate (for versions `v0.7,v0.8,v0.9`), or
* migrate to a more recent version of  the crate (when using `<0.7`).

Doing so elimitates this vulnerability (code no longer compiles).
Vulnerability: RUSTSEC-2021-0047
Summary: SliceDeque::drain_filter can double drop an element if the predicate panics
Aliases: CVE-2021-29938
Published: 2021-02-19T12:00:00Z

Affected versions of the crate incremented the current index of the drain filter
iterator *before* calling the predicate function `self.pred`.

If the predicate function panics, it is possible for the last element in the
iterator to be dropped twice.
Vulnerability: RUSTSEC-2020-0149
Summary: Data race and memory safety issue in `Index`
Aliases: CVE-2020-36469
Published: 2020-11-15T12:00:00Z

The `appendix` crate implements a key-value mapping data structure called
`Index<K, V>` that is stored on disk. The crate allows for any type to inhabit
the generic `K` and `V` type parameters and implements Send and Sync for them
unconditionally.

Using a type that is not marked as `Send` or `Sync` with `Index` can allow it
to be used across multiple threads leading to data races. Additionally using
reference types for the keys or values will lead to the segmentation faults
in the crate's code.
Vulnerability: GHSA-qg24-8xj4-gj2h
Summary: Unaligned memory allocation in chunky
Aliases: CVE-2020-36433
Severity: HIGH
CWE: CWE-758
Published: 2021-08-25T20:58:13Z

An issue was discovered in the chunky crate through 2020-08-25 for Rust. The Chunk API does not honor an alignment requirement.
Vulnerability: RUSTSEC-2021-0010
Summary: panic safety: double drop may happen within `util::{mutate, mutate2}`
Aliases: CVE-2021-25907
Published: 2021-01-12T12:00:00Z

Upon panic in a user-provided function `f`, `fn mutate()` & `fn mutate2` drops twice a same object.

Affected versions of this crate did not guard against double drop while temporarily duplicating an object's ownership with `ptr::read()`.

Dropping a same object can result in memory corruption.

The flaw was corrected in version "0.9.11" by fixing the code to abort upon panic.
Vulnerability: RUSTSEC-2019-0026
Summary: generichash::Digest::eq always return true
Aliases: CVE-2019-25002
Published: 2019-10-11T12:00:00Z

PartialEq implementation for generichash::Digest has compared itself to itself.

Digest::eq always returns true and Digest::ne always returns false.
Vulnerability: GHSA-438g-fx34-4h9m
Summary: Out of bounds read in simple-slab
Aliases: CVE-2020-35892
Severity: CRITICAL
CWE: CWE-125
Published: 2021-08-25T20:48:38Z

An issue was discovered in the simple-slab crate before 0.3.3 for Rust. index() allows an out-of-bounds read.
Vulnerability: GHSA-rpxm-vmr7-5f5f
Summary: Data races in convec
Aliases: CVE-2020-36445
Severity: HIGH
CWE: CWE-119, CWE-362
Published: 2021-08-25T20:59:15Z

Affected versions of this crate unconditionally implement Send/Sync for `ConVec<T>`.
This allows users to insert `T` that is not Send or not Sync.

This allows users to create data races by using non-Send types like `Arc<Cell<_>>` or `Rc<_>` as `T` in `ConVec<T>`. It is also possible to create data races by using types like `Cell<_>` or `RefCell<_>` as `T` (types that are `Send` but not `Sync`).
Such data races can lead to memory corruption.
Vulnerability: GHSA-5q2r-92f9-4m49
Summary: Improper verification of signature threshold in tough
Aliases: CVE-2020-15093
Severity: HIGH
CWE: CWE-347
Published: 2021-08-25T20:56:55Z

## Impact

The tough library, prior to 0.7.1, does not properly verify the uniqueness of keys in the signatures provided to meet the threshold of cryptographic signatures. It allows someone with access to a valid signing key to create multiple valid signatures in order to circumvent TUF requiring a minimum threshold of unique keys before the metadata is considered valid.

AWS would like to thank Erick Tryzelaar of the Google Fuchsia Team for reporting this issue. 

## Patches

A fix is available in version 0.7.1.

## Workarounds

No workarounds to this issue are known.

## References

CVE-2020-6174 is assigned to the same issue in the TUF reference implementation.

https://github.com/theupdateframework/tuf/pull/974
https://nvd.nist.gov/vuln/detail/CVE-2020-6174

## For more information

If you have any questions or comments about this advisory, [contact AWS Security](https://aws.amazon.com/security/vulnerability-reporting/) at [aws-security@amazon.com](mailto:aws-security@amazon.com).
Vulnerability: GHSA-q89x-f52w-6hj2
Summary: Headers containing newline characters can split messages in hyper
Aliases: CVE-2017-18587
Severity: MODERATE
CWE: CWE-93
Published: 2021-08-25T20:43:04Z

An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.
Vulnerability: GHSA-g7r5-x7cr-vm3v
Summary: Buffer overflow and format vulnerabilities in ncurses
Aliases: CVE-2019-15548
Severity: CRITICAL
CWE: CWE-119
Published: 2021-08-25T20:58:29Z

An issue was discovered in the ncurses crate for Rust. There are instr and mvwinstr buffer overflows because interaction with C functions is mishandled.
Vulnerability: RUSTSEC-2021-0067
Summary: Memory access due to code generation flaw in Cranelift module
Aliases: CVE-2021-32629, GHSA-hpqh-2wqx-7qp5
Published: 2021-05-21T12:00:00Z

There is a bug in 0.73.0 of the Cranelift x64 backend that can create a
scenario that could result in a potential sandbox escape in a WebAssembly
module. Users of versions 0.73.0 of Cranelift should upgrade to either 0.73.1
or 0.74 to remediate this vulnerability. Users of Cranelift prior to 0.73.0
should update to 0.73.1 or 0.74 if they were not using the old default backend.

More details can be found in the GitHub Security Advisory at:

<https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hpqh-2wqx-7qp5>
Vulnerability: GHSA-qc4m-gc8r-mg8m
Summary: Double free in alpm-rs
Aliases: CVE-2020-35885
Severity: CRITICAL
CWE: CWE-415
Published: 2021-08-25T20:48:59Z

An issue was discovered in the alpm-rs crate through 2020-08-20 for Rust. StrcCtx performs improper memory deallocation.
Vulnerability: GHSA-85j6-f8j6-q26x
Summary: Unaligned references in Obstack
Aliases: CVE-2020-35894
Severity: HIGH
CWE: CWE-706
Published: 2021-08-25T20:48:12Z

An issue was discovered in the obstack crate before 0.1.4 for Rust. Unaligned references can occur.
Vulnerability: RUSTSEC-2021-0122
Summary: Generated code can read and write out of bounds in safe code
Published: 2021-10-31T12:00:00Z

Code generated by flatbuffers' compiler is `unsafe` but not marked as such.
See https://github.com/google/flatbuffers/issues/6627 for details.

All users that use generated code by `flatbuffers` compiler are recommended to:
1. not expose flatbuffer generated code as part of their public APIs
2. audit their code and look for any usage of `follow`, `push`, or any method that uses them
   (e.g. `self_follow`).
3. Carefuly go through the crates' documentation to understand which "safe" APIs are not
   intended to be used.
Vulnerability: RUSTSEC-2021-0088
Summary: `Read` on uninitialized memory may cause UB (fn preamble_skipcount())
Published: 2021-01-05T12:00:00Z

Affected versions of this crate passes an uninitialized buffer to a user-provided `Read` implementation (within `fn preamble_skipcount()`).

Arbitrary `Read` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer.
Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.
Vulnerability: RUSTSEC-2020-0094
Summary: Unsound: can make `ARefss` contain a !Send, !Sync object.
Aliases: CVE-2020-36203
Published: 2020-12-01T12:00:00Z

`ARefss<'a, V>` is a type that is assumed to contain objects that are `Send + Sync`.

In the affected versions of this crate,
`Send`/`Sync` traits are unconditionally implemented for `ARefss<'a, V>`.

By using the `ARefss::map()` API, we can insert a `!Send` or `!Sync` object into `ARefss<'a, V>`. After that, it is possible to create a data race to the inner object of `ARefss<'a, V>`, which can lead to undefined behavior & memory corruption.

The flaw was corrected in commit 6dd7ca0 (https://github.com/diwic/reffers-rs/commit/6dd7ca0d50f2464df708975cdafcfaeeb6d41c66) by adding trait bound `V: Send + Sync` to `ARefss::map()` API.
Vulnerability: GHSA-f997-8gxg-r354
Summary: Data races in lexer
Aliases: CVE-2020-36458
Severity: HIGH
CWE: CWE-77, CWE-362
Published: 2021-08-25T20:58:09Z

lexer is a plugin based lexical reader.Affected versions of this crate implements Sync for ReaderResult<T, E> with the trait bound T: Send, E: Send. Since matching on the public enum ReaderResult<T, E> provides access to &T & &E, allowing data race to a non-Sync type T or E. This can result in a memory corruption when multiple threads concurrently access &T or &E. Suggested fix for the bug is change the trait bounds imposed on T & E to be T: Sync, E: Sync.
Vulnerability: GHSA-q948-x8rf-888m
Summary: os_str_bytes relies on undefined behavior of `char::from_u32_unchecked`
Aliases: CVE-2020-35865
Severity: HIGH
CWE: CWE-704
Published: 2021-08-25T20:47:55Z

An issue was discovered in the os_str_bytes crate before 2.0.0 for Rust. It has false expectations about char::from_u32_unchecked behavior.
Vulnerability: GHSA-r56q-vv3c-6g9c
Summary: Improper sanitization of delegated role names
Aliases: CVE-2021-41150
Severity: HIGH
CWE: CWE-22
Published: 2021-10-19T20:16:26Z

### Impact
The tough library, prior to 0.12.0, does not properly sanitize delegated role names when caching a repository, or when loading a repository from the filesystem. When the repository is cached or loaded, files ending with the .json extension could be overwritten with role metadata anywhere on the system.

AWS would like to thank https://github.com/jku for reporting this issue.

### Patches
A fix is available in version 0.12.0.

### Workarounds
No workarounds to this issue are known.

### References
https://github.com/theupdateframework/python-tuf/security/advisories/GHSA-wjw6-2cqr-j4qr
Vulnerability: GHSA-ff2r-xpwq-6whj
Summary: Use of Uninitialized Resource in gfx-auxil
Aliases: CVE-2021-45689
Severity: CRITICAL
CWE: CWE-908
Published: 2022-01-06T22:12:14Z

An issue was discovered in the gfx-auxil crate through 2021-01-07 for Rust. gfx_auxil::read_spirv may read from uninitialized memory locations.
Vulnerability: RUSTSEC-2019-0006
Summary: Buffer overflow and format vulnerabilities in functions exposed without unsafe
Aliases: CVE-2019-15548, CVE-2019-15547
Published: 2019-06-15T12:00:00Z

`ncurses` exposes functions from the ncurses library which:

- Pass buffers without length to C functions that may write an arbitrary amount of
  data, leading to a buffer overflow. (`instr`, `mvwinstr`, etc)
- Passes rust &str to strings expecting C format arguments, allowing hostile
  input to execute a format string attack, which trivially allows writing
  arbitrary data to stack memory (functions in the `printw` family).
Vulnerability: GHSA-cjg2-2fjg-fph4
Summary: Integer underflow in Frontier
Aliases: CVE-2022-21685
Severity: MODERATE
CWE: CWE-191
Published: 2022-01-14T21:03:36Z

### Impact

A bug in Frontier's MODEXP precompile implementation can cause an integer underflow in certain conditions. This will cause a node crash for debug builds. For release builds (and production WebAssembly binaries), the impact is limited as it can only cause a normal EVM out-of-gas. It is recommended that you apply the patch as soon as possible.

If you do not use MODEXP precompile in your runtime, then you are not impacted.

### Patches

Patches are applied in PR #549.

### Workarounds

None.

### References

Patch PR: #549

### Credits

Thanks to SR-Labs for discovering the security vulnerability, and thanks to PureStake team for the patches.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in the [Frontier repo](https://github.com/paritytech/frontier)
Vulnerability: GHSA-352p-rhvq-7g78
Summary: Null pointer deference in av-data
Aliases: CVE-2021-25904
Severity: HIGH
CWE: CWE-476
Published: 2021-08-25T20:52:55Z

An issue was discovered in the av-data crate before 0.3.0 for Rust. A raw pointer is dereferenced, leading to a read of an arbitrary memory address, sometimes causing a segfault.
Vulnerability: GHSA-g4rw-8m5q-6453
Summary: Out of bounds access in rgb
Aliases: CVE-2020-25016
Severity: CRITICAL
CWE: CWE-843, CWE-119
Published: 2021-08-25T20:45:12Z

A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to (for example) dereferencing of arbitrary pointers or disclosure of uninitialized memory. This occurs because structs can be treated as bytes for read and write operations.
Vulnerability: RUSTSEC-2021-0030
Summary: move_elements can double-free objects on panic
Aliases: CVE-2021-28031
Published: 2021-02-18T12:00:00Z

Affected versions of `scratchpad` used `ptr::read` to read elements while
calling a user provided function `f` on them.

Since the pointer read duplicates ownership, a panic inside the user provided
`f` function could cause a double free when unwinding.

The flaw was fixed in commit `891561bea` by removing the unsafe block and using
a plain iterator.
Vulnerability: GHSA-jwfh-j623-m97h
Summary: Use of Uninitialized Resource in messagepack-rs
Aliases: CVE-2021-45691
Severity: CRITICAL
CWE: CWE-908
Published: 2022-01-06T22:12:35Z

An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_string may read from uninitialized memory locations.
Vulnerability: GHSA-vj62-g63v-f8mf
Summary: Validity check missing in Frontier
Aliases: CVE-2021-41138
Severity: MODERATE
CWE: CWE-20
Published: 2021-10-13T18:53:38Z

### Impact

In the newly introduced signed Frontier-specific extrinsic for `pallet-ethereum`, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of this to put invalid transactions into a block.

The attack is limited in that the signature is always validated, and the majority of the validation is done again in the subsequent `pallet-evm` execution logic. However, do note that a chain ID replay attack was possible. In addition, spamming attacks are of main concerns, while they are limited by Substrate block size limits and other factors.

### Patches

The issue is patched in commit 146bb48849e5393004be5c88beefe76fdf009aba.

### References

Patch PR: https://github.com/paritytech/frontier/pull/495

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Frontier repo](https://github.com/paritytech/frontier/issues)

### Special thanks

Special thanks to @librelois, @nanocryk and the Moonbeam team for reporting and fixing this security vulnerability.
Vulnerability: GHSA-x3r5-q6mj-m485
Summary: Improper sanitization of target names
Aliases: CVE-2021-41149
Severity: HIGH
CWE: CWE-22
Published: 2021-10-19T20:16:15Z

### Impact
The tough library, prior to 0.12.0, does not properly sanitize target names when caching a repository, or when saving specific targets to an output directory. When targets are cached or saved, files could be overwritten with arbitrary content anywhere on the system.

AWS would like to thank https://github.com/jku for reporting this issue.

### Patches
A fix is available in version 0.12.0.

### Workarounds
No workarounds to this issue are known.
Vulnerability: RUSTSEC-2020-0082
Summary: ordered_float:NotNan may contain NaN after panic in assignment operators
Aliases: CVE-2020-35923
Published: 2020-12-06T12:00:00Z

After using an assignment operators such as `NotNan::add_assign`, `NotNan::mul_assign`, etc., it was possible for the resulting `NotNan` value to contain a `NaN`.  This could cause undefined behavior in safe code, because the safe `NotNan::cmp` method contains internal unsafe code that assumes the value is never `NaN`.  (It could also cause undefined behavior in third-party unsafe code that makes the same assumption, as well as logic errors in safe code.)

This was mitigated starting in version 0.4.0, by panicking if the assigned value is NaN.  However, in affected versions from 0.4.0 onward, code that uses the `NotNan` value during unwinding, or that continues after catching the panic, could still observe the invalid value and trigger undefined behavior.

The flaw is fully corrected in versions 1.1.1 and 2.0.1, by ensuring that the assignment operators panic without modifying the operand, if the result would be `NaN`.
Vulnerability: RUSTSEC-2020-0128
Summary: Cache<K>: Send/Sync impls needs trait bounds on `K`
Aliases: CVE-2020-36448
Published: 2020-11-24T12:00:00Z

Affected versions of this crate unconditionally implement Send/Sync for `Cache<K>`.
This allows users to insert `K` that is not Send or not Sync.

This allows users to create data races by using non-Send types like `Arc<Cell<T>>` or `Rc<T>` as `K` in `Cache<K>`. It is also possible to create data races by using types like `Cell<T>` or `RefCell<T>` (types that are `Send` but not `Sync`).
Such data races can lead to memory corruption.
Vulnerability: RUSTSEC-2019-0010
Summary: MultiDecoder::read() drops uninitialized memory of arbitrary type on panic in client code
Aliases: CVE-2019-15552
Published: 2019-07-04T12:00:00Z

Affected versions of libflate have set a field of an internal structure with a generic type to an uninitialized value in `MultiDecoder::read()` and reverted it to the original value after the function completed. However, execution of `MultiDecoder::read()` could be interrupted by a panic in caller-supplied `Read` implementation. This would cause `drop()` to be called on uninitialized memory of a generic type implementing `Read`.

This is equivalent to a use-after-free vulnerability and could allow an attacker to gain arbitrary code execution.

The flaw was corrected by aborting immediately instead of unwinding the stack in case of panic within `MultiDecoder::read()`. The issue was discovered and fixed by Shnatsel.
Vulnerability: GHSA-hv87-47h9-jcvq
Summary: Uncontrolled recursion in rust-yaml
Aliases: CVE-2018-20993
Severity: HIGH
CWE: CWE-674
Published: 2021-08-25T20:43:13Z

An issue was discovered in the yaml-rust crate before 0.4.1 for Rust. There is uncontrolled recursion during deserialization.
Vulnerability: RUSTSEC-2021-0026
Summary: XSS in `comrak`
Aliases: CVE-2021-27671
Published: 2021-02-21T12:00:00Z

The [comrak](https://github.com/kivikakk/comrak) we were matching unsafe URL prefixes, such as `data:` or `javascript:` , in a case-sensitive manner. This meant prefixes like `Data:` were untouched.
Vulnerability: GHSA-fjr6-hm39-4cf9
Summary: Double free in basic_dsp_matrix
Aliases: CVE-2021-25906
Severity: HIGH
CWE: CWE-415
Published: 2021-08-25T20:52:50Z

An issue was discovered in the basic_dsp_matrix crate before 0.9.2 for Rust. When a TransformContent panic occurs, a double drop can be performed.
Vulnerability: GHSA-g78p-g85h-q6ww
Summary: Data races in cache
Aliases: CVE-2020-36448
Severity: HIGH
CWE: CWE-77, CWE-362
Published: 2021-08-25T20:57:12Z

An issue was discovered in the cache crate through 2020-11-24 for Rust. 
Affected versions of this crate unconditionally implement Send/Sync for `Cache<K>`.
This allows users to insert `K` that is not Send or not Sync.

This allows users to create data races by using non-Send types like `Arc<Cell<T>>` or `Rc<T>` as `K` in `Cache<K>`. It is also possible to create data races by using types like `Cell<T>` or `RefCell<T>` (types that are `Send` but not `Sync`).
Such data races can lead to memory corruption.
Vulnerability: GHSA-qwvx-c8j7-5g75
Summary: Use of Uninitialized Resource in tectonic_xdv
Aliases: CVE-2021-45703
Severity: CRITICAL
CWE: CWE-908
Published: 2022-01-06T22:09:19Z

An issue was discovered in the tectonic_xdv crate before 0.1.12 for Rust. XdvParser::<T>::process may read from uninitialized memory locations.
Vulnerability: RUSTSEC-2016-0002
Summary: HTTPS MitM vulnerability due to lack of hostname verification
Aliases: CVE-2016-10932
Published: 2016-05-09T12:00:00Z

When used on Windows platforms, all versions of Hyper prior to 0.9.4 did not
perform hostname verification when making HTTPS requests.

This allows an attacker to perform MitM attacks by preventing any valid
CA-issued certificate, even if there's a hostname mismatch.

The problem was addressed by leveraging rust-openssl's built-in support for
hostname verification.
Vulnerability: GHSA-82hm-vh7g-hrh9
Summary: Partial read is incorrect in molecule
Severity: MODERATE
Published: 2021-08-25T21:01:25Z

### Impact

Anyone who uses `total_size(..)` function to partial read the length of any `FixVec` will get an incorrect result, due to an incorrect implementation. This has been resolved in the 0.7.2 release.

### Workarounds

If you already have the whole `FixVec` `A`, you can use `A.as_slice().len()` to get the total size of the `FixVec`.

### For more information

If you have any questions or comments about this advisory:

- [Open an issue to ask use directly](https://github.com/nervosnetwork/molecule/issues/new).
Vulnerability: RUSTSEC-2021-0071
Summary: `grep-cli` may run arbitrary executables on Windows
Aliases: CVE-2021-3013
Published: 2021-06-12T12:00:00Z

On Windows in versions of `grep-cli` prior to `0.1.6`, it's possible for some
of the routines to execute arbitrary executables. In particular, a quirk of
the Windows process execution API is that it will automatically consider the
current directory before other directories when resolving relative binary
names. Therefore, if you use `grep-cli` to read decompressed files in an
untrusted directory with that directory as the CWD, a malicious actor to could
put, e.g., a `gz.exe` binary in that directory and `grep-cli` will use the
malicious actor's version of `gz.exe` instead of the system's.

This is also technically possible on Unix as well, but only if the `PATH`
variable contains `.`. Conventionally, they do not.

A `DecompressionReader` has been fixed to automatically resolve binary names
using `PATH`, instead of relying on the Windows API to do it.

If you use `grep-cli`'s `CommandReader` with a `std::process::Command` value
on Windows, then it is recommended to either construct the `Command` with an
absolute binary name, or use `grep-cli`'s new
[`resolve_binary`](https://docs.rs/grep-cli/0.1.6/grep_cli/fn.resolve_binary.html)
helper function.

To be clear, `grep-cli 0.1.6` mitigates this issue in two ways:

* A `DecompressionReader` will resolve decompression programs to absolute
paths automatically using the `PATH` environment variable, instead of relying
on Windows APIs to do it (which would result in the undesirable behavior of
checking the CWD for a program first).
* A new function, `resolve_binary`, was added to help users of this crate
mitigate this behavior when they need to create their own
`std::process::Command`. For example,
[ripgrep uses `grep_cli::resolve_binary`](https://github.com/BurntSushi/ripgrep/blob/7ce66f73cf7e76e9f2557922ac8e650eb02cf4ed/crates/core/search.rs#L119-L122)
on the argument given to its `--pre` flag.

While the first mitigation fixes this issue for sensible values of `PATH`
when doing decompression search, the second mitigation is imperfect. The more
fundamental issue is that `std::process::Command` is itself vulnerable to this.
Vulnerability: RUSTSEC-2021-0134
Summary: rental is unmaintained, author has moved on
Published: 2021-12-27T12:00:00Z

The author encourages users to explore other solutions, or maintain a fork.

Maintained alternatives include:

* [`ouroboros`](https://crates.io/crates/ouroboros)
* [`fortify`](https://crates.io/crates/fortify)
* [`escher`](https://crates.io/crates/escher)
Vulnerability: GHSA-r3r5-jhw6-4634
Summary: Insecure temporary file usage in SWHKD
Aliases: CVE-2022-27818
Severity: CRITICAL
CWE: CWE-668
Published: 2022-04-08T00:00:24Z

SWHKD 1.1.5 unsafely uses the /tmp/swhkd.sock pathname. There can be an information leak or denial of service.
Vulnerability: RUSTSEC-2020-0041
Summary: Multiple soundness issues in Chunk and InlineArray
Aliases: CVE-2020-25792, CVE-2020-25794, CVE-2020-25793, CVE-2020-25795, CVE-2020-25796, CVE-2020-25791
Published: 2020-09-06T12:00:00Z

Chunk:

* Array size is not checked when constructed with `unit()` and `pair()`.
* Array size is not checked when constructed with `From<InlineArray<A, T>>`.
* `Clone` and `insert_from` are not panic-safe; A panicking iterator causes memory safety issues with them.

InlineArray:

* Generates unaligned references for types with a large alignment requirement.
Vulnerability: RUSTSEC-2020-0104
Summary: ImageChunkMut needs bounds on its Send and Sync traits
Aliases: CVE-2020-36211
Published: 2020-12-08T12:00:00Z

In the affected versions of this crate, `ImageChunkMut<'_, T>` unconditionally implements `Send` and `Sync`, allowing to create data races.

This can result in a memory corruption or undefined behavior when non thread-safe types are moved and referenced across thread boundaries.

The flaw was corrected in commit e7fb2f5 by adding `T: Send` bound to the `Send` impl and adding `T: Sync` bound to the `Sync` impl.
Vulnerability: GHSA-qgwf-r2jj-2ccv
Summary: Use after free in heapless
Aliases: CVE-2020-36464
Severity: HIGH
CWE: CWE-416
Published: 2021-08-25T20:56:09Z

An issue was discovered in the heapless crate before 0.6.1 for Rust. The IntoIter Clone implementation clones an entire underlying Vec without considering whether it has already been partially consumed.
Vulnerability: GHSA-x76r-966h-5qv9
Summary: Out-of-bounds Write in vec-const
Aliases: CVE-2021-45680
Severity: HIGH
CWE: CWE-787
Published: 2022-01-06T22:15:56Z

An issue was discovered in the vec-const crate before 2.0.0 for Rust. It tries to construct a Vec from a pointer to a const slice, leading to memory corruption.
Vulnerability: GHSA-8892-84wf-cg8f
Summary: SyncChannel<T> can move 'T: !Send' to other threads
Severity: MODERATE
CWE: CWE-362
Published: 2021-08-25T21:00:16Z

Affected versions of this crate unconditionally implement Send/Sync for `SyncChannel<T>`.
`SyncChannel<T>` doesn't provide access to `&T` but merely serves as a channel that consumes and returns owned `T`.

Users can create UB in safe Rust by sending `T: !Send` to other threads with `SyncChannel::send/recv` APIs. Using `T = Arc<Cell<_>` allows to create data races (which can lead to memory corruption), and using `T = MutexGuard<T>` allows to unlock a mutex from a thread that didn't lock the mutex.
Vulnerability: GHSA-9cg2-2j2h-59v9
Summary: Data races in atom
Aliases: CVE-2020-35897
Severity: MODERATE
CWE: CWE-362
Published: 2021-08-25T20:49:11Z

An issue was discovered in the atom crate before 0.3.6 for Rust. An unsafe Send implementation allows a cross-thread data race.
Vulnerability: RUSTSEC-2020-0016
Summary: `net2` crate has been deprecated; use `socket2` instead
Published: 2020-05-01T12:00:00Z

The [`net2`](https://crates.io/crates/net2) crate has been deprecated
and users are encouraged to considered [`socket2`](https://crates.io/crates/socket2) instead.
Vulnerability: GHSA-f3fg-5j9p-vchc
Summary: File exposure in pleaser
Aliases: CVE-2021-31153
Severity: MODERATE
CWE: CWE-200, CWE-668
Published: 2021-08-25T21:01:41Z

pleaser before 0.4 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.
Vulnerability: RUSTSEC-2020-0153
Summary: `read` on uninitialized buffer may cause UB (bite::read::BiteReadExpandedExt::read_framed_max)
Published: 2020-12-31T12:00:00Z

Affected versions of this crate calls a user provided `Read` implementation on an uninitialized buffer.

`Read` on uninitialized buffer is defined as undefined behavior in Rust.
Vulnerability: RUSTSEC-2021-0118
Summary: `FixedSizeBinaryArray` does not perform bound checks on accessing values and offsets
Published: 2021-09-14T12:00:00Z

`FixedSizeBinaryArray` performs insufficient bounds checks, which allows out-of-bounds reads in safe code.
Vulnerability: RUSTSEC-2022-0008
Summary: Delegate functions are missing `Send` bound
Published: 2022-01-02T12:00:00Z

Affected versions of this crate did not require event handlers to have `Send` bound despite there being no guarantee of them being called on any particular thread, which can potentially lead to data races and undefined behavior.

The flaw was corrected in commit [afe3252](https://github.com/microsoft/windows-rs/commit/afe32525c22209aa8f632a0f4ad607863b51796a) by adding `Send` bounds.
Vulnerability: RUSTSEC-2018-0020
Summary: Possible use-after-free with `proplist::Iterator`
Aliases: CVE-2018-25001, GHSA-6gvc-4jvj-pwq4
Published: 2018-12-22T12:00:00Z

Affected versions contained a possible use-after-free issue with property list iteration
due to a lack of a lifetime constraint tying the lifetime of a `proplist::Iterator` to the
`Proplist` object for which it was created. This made it possible for users, without
experiencing a compiler error/warning, to destroy the `Proplist` object before the iterator,
thus destroying the underlying C object the iterator works upon, before the iterator may be
finished with it.

This impacts all versions of the crate before `2.5.0` back to `1.0.5`. Before version
`1.0.5` the function that produces the iterator was broken to the point of being useless.
Vulnerability: RUSTSEC-2020-0145
Summary: Use-after-free when cloning a partially consumed `Vec` iterator
Aliases: CVE-2020-36464
Published: 2020-11-02T12:00:00Z

The `IntoIter` `Clone` implementation clones the whole underlying `Vec`.
If the iterator is partially consumed the consumed items will be copied, thus creating a use-after-free access.

A proof of concept is available in the original bug report.
Vulnerability: GHSA-6wj2-g87r-pm62
Summary: Cross-site Scripting in comrak
Aliases: CVE-2021-38186
Severity: MODERATE
CWE: CWE-79
Published: 2021-08-25T20:55:43Z

An issue was discovered in the comrak crate before 0.10.1 for Rust. It mishandles & characters, leading to XSS via &# HTML entities.
Vulnerability: GHSA-9f5r-vqm5-m342
Summary: Use of Uninitialized Resource in ms3d
Aliases: CVE-2021-26952
Severity: HIGH
CWE: CWE-908
Published: 2021-08-25T20:53:16Z

An issue was discovered in the ms3d crate before 0.1.3 for Rust. It might allow attackers to obtain sensitive information from uninitialized memory locations via IoReader::read.
Vulnerability: RUSTSEC-2020-0057
Summary: crate has been renamed to `cipher`
Published: 2020-10-15T12:00:00Z

This crate has been renamed from `block-cipher` to `cipher`.

The new repository location is at:

<https://github.com/RustCrypto/traits/tree/master/cipher>
Vulnerability: GHSA-9frf-r7c7-j2vg
Summary: Out of bounds write in stackvector
Aliases: CVE-2021-29939
Severity: HIGH
CWE: CWE-787
Published: 2021-08-25T20:54:14Z

An issue was discovered in the stackvector crate before 1.0.9 for Rust. There is an out-of-bounds write in StackVec::extend if size_hint provides certain anomalous data.
Vulnerability: RUSTSEC-2020-0112
Summary: ButtplugFutureStateShared allows data race to (!Send|!Sync) objects
Aliases: CVE-2020-36218
Published: 2020-12-18T12:00:00Z

`ButtplugFutureStateShared<T>` implements `Send` & `Sync` regardless of `T`.

If `T: !Send` for `ButtplugFutureStateShared<T>`, it is possible to move non-Send types across thread boundaries (e.g. `T`=`Rc<T>`) and lead to undefined behavior.
If `T: !Sync` for `ButtplugFutureStateShared<T>`, it is possible to cause data race to `T` (e.g. `T`=`Arc<Cell<_>>`) and lead to undefined behavior.

The flaw was corrected in version 1.0.4 by removing manual implementations of `Send`/`Sync` for `ButtplugFutureStateShared<T>` to let rustc generate auto trait implementations with correct trait bounds on `T`.
Vulnerability: GHSA-jh37-772x-4hpw
Summary: Double free in algorithmica
Aliases: CVE-2021-31996
Severity: HIGH
CWE: CWE-415
Published: 2021-08-25T21:01:52Z

An issue was discovered in the algorithmica crate through 2021-03-07 for Rust. In the affected versions of this crate, `merge_sort::merge()` wildly duplicates and drops ownership of `T` without guarding against double-free. Due to such implementation, simply invoking `merge_sort::merge()` on `Vec<T: Drop>` can cause **double free** bugs.
Vulnerability: GHSA-pp74-39w2-v4w9
Summary: Permissions bypass in pleaser
Aliases: CVE-2021-31154
Severity: HIGH
CWE: CWE-59, CWE-340
Published: 2021-08-25T21:01:44Z

pleaseedit in pleaser before 0.4 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.
Vulnerability: GHSA-p6j9-7xhc-rhwp
Summary: Hostname spoofing via backslashes in URL
Aliases: CVE-2021-27516
Severity: MODERATE
CWE: CWE-20
Published: 2021-03-01T20:03:53Z

### Impact
If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a backslash (`\`) character as part of the scheme delimiter, e.g. `scheme:/\hostname`. If the hostname is used in security decisions, the decision may be incorrect.

Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.

Example URL: `https:/\expected-example.com/path`
Escaped string: `https:/\\expected-example.com/path` (JavaScript strings must escape backslash)

Affected versions incorrectly return no hostname. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the [WHATWG URL specification](https://url.spec.whatwg.org/), including web browsers and [Node's built-in URL class](https://nodejs.org/api/url.html).

### Patches
Version 1.19.6 is patched against all known payload variants.

### References
https://github.com/medialize/URI.js/releases/tag/v1.19.6 (fix for this particular bypass)
https://github.com/medialize/URI.js/releases/tag/v1.19.4 (fix for related bypass)
https://github.com/medialize/URI.js/releases/tag/v1.19.3 (fix for related bypass)
[PR #233](https://github.com/medialize/URI.js/pull/233) (initial fix for backslash handling)

### For more information
If you have any questions or comments about this advisory, open an issue in https://github.com/medialize/URI.js

### Reporter credit
[Yaniv Nizry](https://twitter.com/ynizry) from the CxSCA AppSec team at Checkmarx
Vulnerability: GHSA-vpch-rxw3-fgx8
Summary: Cross-Site Scripting in @risingstack/protect
Aliases: CVE-2018-1000160
Severity: MODERATE
CWE: CWE-79
Published: 2018-04-25T14:30:43Z

All versions of `@risingstack/protect` are vulnerable to Cross-Site Scripting. The  `isXss()` XSS validator has several bypasses that may allow attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

No fix is currently available. Consider using an alternative package. The package is not actively maintained and will not be patched.
Vulnerability: GHSA-9v62-24cr-58cx
Summary: Denial of Service in node-sass
Severity: MODERATE
CWE: CWE-400
Published: 2020-09-11T21:12:39Z

Affected versions of `node-sass` are vulnerable to Denial of Service (DoS). Crafted objects passed to the `renderSync` function may trigger C++ assertions in `CustomImporterBridge::get_importer_entry` and `CustomImporterBridge::post_process_return_value` that crash the Node process. This may allow attackers to crash the system's running Node process and lead to Denial of Service.


## Recommendation

Upgrade to version 4.13.1 or later