TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-955p-rc5h-hg6h
Summary: Double free in arenavec
Aliases: CVE-2021-29931
Severity: HIGH
CWE: CWE-415
Published: 2021-08-25T20:55:04Z

An issue was discovered in the arenavec crate through 2021-01-12 for Rust. A double drop can sometimes occur upon a panic in T::drop().
Vulnerability: RUSTSEC-2020-0006
Summary: Flaw in `realloc` allows reading unknown memory
Aliases: CVE-2020-35861
Published: 2020-03-24T12:00:00Z

When `realloc`ing, if we allocate new space, we need to copy the old
allocation's bytes into the new space. There are `old_size` number of bytes in
the old allocation, but we were accidentally copying `new_size` number of bytes,
which could lead to copying bytes into the realloc'd space from past the chunk
that we're bump allocating out of, from unknown memory.

If an attacker can cause `realloc`s, and can read the `realoc`ed data back,
this could allow them to read things from other regions of memory that they
shouldn't be able to. For example, if some crypto keys happened to live in
memory right after a chunk we were bump allocating out of, this could allow
the attacker to read the crypto keys.

Beyond just fixing the bug and adding a regression test, I've also taken two
additional steps:

1. While we were already running the testsuite under `valgrind` in CI, because
   `valgrind` exits with the same code that the program did, if there are
   invalid reads/writes that happen not to trigger a segfault, the program can
   still exit OK and we will be none the wiser. I've enabled the
   `--error-exitcode=1` flag for `valgrind` in CI so that tests eagerly fail
   in these scenarios.

2. I've written a quickcheck test to exercise `realloc`. Without the bug fix
   in this patch, this quickcheck immediately triggers invalid reads when run
   under `valgrind`. We didn't previously have quickchecks that exercised
   `realloc` because `realloc` isn't publicly exposed directly, and instead
   can only be indirectly called. This new quickcheck test exercises `realloc`
   via `bumpalo::collections::Vec::resize` and
   `bumpalo::collections::Vec::shrink_to_fit` calls.
Vulnerability: GHSA-vq23-5h4f-vwpv
Summary: Update unsound DrainFilter and RString::retain
Aliases: CVE-2020-36212
Severity: HIGH
CWE: CWE-672
Published: 2021-08-25T21:01:35Z

An issue was discovered in the abi_stable crate before 0.9.1 for Rust. DrainFilter lacks soundness because of a double drop.
Vulnerability: RUSTSEC-2020-0143
Summary: Queues allow non-Send types to be sent to other threads, allowing data races
Aliases: CVE-2020-36463
Published: 2020-12-25T12:00:00Z

Affected versions of this crate unconditionally implemented `Send` for types used in queue implementations (`InnerSend<RW, T>`, `InnerRecv<RW, T>`, `FutInnerSend<RW, T>`, `FutInnerRecv<RW, T>`).

This allows users to send non-Send types to other threads, which can lead to data race bugs or other undefined behavior.
Vulnerability: GHSA-64wv-8vwp-xgw2
Summary: Use of Uninitialized Resource in ash.
Aliases: CVE-2021-45688
Severity: CRITICAL
CWE: CWE-908
Published: 2022-01-06T22:13:02Z

An issue was discovered in the ash crate before 0.33.1 for Rust. util::read_spv may read from uninitialized memory locations.
Vulnerability: RUSTSEC-2021-0108
Summary: Remote memory exhaustion in ckb
Aliases: GHSA-48vq-8jqv-gm6f
Published: 2021-07-25T12:00:00Z

In the ckb sync protocol, SyncState maintains a HashMap called 'misbehavior' that keeps a score of a peer's violations of the protocol. This HashMap is keyed to PeerIndex (an alias for SessionId), and entries are never removed from it. SessionId is an integer that increases monotonically with every new connection.

A remote attacker can manipulate this HashMap to grow forever, resulting in degraded performance and ultimately a panic on allocation failure or being killed by the OS, depending on the platform.

This is a critical severity security bug. It could be exploited to create a targeted or network-wide denial of service, to reduce the hash power of the network as part of a 51% attack, and perhaps in other creative ways.
Vulnerability: RUSTSEC-2022-0018
Summary: Timing attack
Aliases: CVE-2022-29185
Published: 2022-05-09T12:00:00Z

Affecting versions did not compare tokens in constant time, which could make it possible for an attacker to guess the 2fa token of a user.

This has been fixed by using using the crate constant_time_eq for comparison.
Vulnerability: GHSA-799f-r78p-gq9c
Summary: Use of Uninitialized Resource in acc_reader.
Aliases: CVE-2020-36513
Severity: CRITICAL
CWE: CWE-908
Published: 2022-01-06T22:17:38Z

An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. read_up_to may read from uninitialized memory locations.
Vulnerability: RUSTSEC-2020-0051
Summary: Obsolete versions of the `rustsec` crate do not support the new V3 advisory format
Published: 2020-10-01T12:00:00Z

If you are seeing this message, you are running an obsolete version of
`cargo-audit` which does not support the new V3 advisory format.
These versions are end-of-life.

This advisory is a notice that that it will soon be unable to parse the
advisory database.

Please upgrade `cargo-audit` to a newer release.
Vulnerability: GHSA-jwph-qp5h-f9wj
Summary: Data races in bunch
Aliases: CVE-2020-36450
Severity: HIGH
CWE: CWE-77, CWE-362
Published: 2021-08-25T20:59:18Z

An issue was discovered in the bunch crate through 2020-11-12 for Rust. 
Affected versions of this crate unconditionally implements `Send`/`Sync` for `Bunch<T>`.
This allows users to insert `T: !Sync` to `Bunch<T>`. It is possible to create a data race to a `T: !Sync` by invoking the `Bunch::get()` API (which returns `&T`) from multiple threads. It is also possible to send `T: !Send` to other threads by inserting `T` inside `Bunch<T>` and sending `Bunch<T>` to another thread, allowing to create a data race by inserting types like `T = Rc<_>`.

Such data races can lead to memory corruption.
Vulnerability: RUSTSEC-2020-0114
Summary: `Demuxer` can carry non-Send types across thread boundaries
Aliases: CVE-2020-36220
Published: 2020-12-22T12:00:00Z

In the affected versions of this crate, `Demuxer<T>` unconditionally implemented `Send` with no trait bounds on `T`.

This allows sending a non-Send type `T` across thread boundaries, which can cause undefined behavior like unlocking a mutex from a thread that didn't lock the mutex, or memory corruption from data race.

The flaw was corrected in commit 0562cbf by adding a `T: Send` bound to the `Send` impl for `Demuxer<T>`.
Vulnerability: GHSA-m7w4-8wp8-m2xq
Summary: Data races in beef
Aliases: CVE-2020-36442
Severity: HIGH
CWE: CWE-119, CWE-362
Published: 2021-08-25T20:59:08Z

An issue was discovered in the beef crate before 0.5.0 for Rust. 
Affected versions of this crate did not have a `T: Sync` bound in the `Send` impl for `Cow<'_, T, U>`. This allows users to create data races by making `Cow` contain types that are (Send && !Sync) like `Cell<_>` or `RefCell<_>`.

Such data races can lead to memory corruption.

The flaw was corrected in commit d1c7658 by adding trait bounds `T: Sync` and `T::Owned: Send` to the `Send` impl for `Cow<'_, T, U>`.
Vulnerability: RUSTSEC-2018-0010
Summary: Use after free in CMS Signing
Aliases: CVE-2018-20997
Published: 2018-06-01T12:00:00Z

Affected versions of the OpenSSL crate used structures after they'd been freed.
Vulnerability: RUSTSEC-2021-0082
Summary: vec-const attempts to construct a Vec from a pointer to a const slice
Published: 2021-08-14T12:00:00Z

Affected versions of this crate claimed to construct a const `Vec` with nonzero length and capacity, but that cannot be done because such a `Vec` requires a pointer from an allocator.

The implementation was later changed to just construct a `std::borrow::Cow`.
Vulnerability: RUSTSEC-2021-0128
Summary: Incorrect Lifetime Bounds on Closures in `rusqlite`
Published: 2021-12-07T12:00:00Z

The lifetime bound on several closure-accepting `rusqlite` functions (specifically, functions which register a callback to be later invoked by SQLite) was too relaxed. If a closure referencing borrowed values on the stack is was passed to one of these functions, it could allow Rust code to access objects on the stack after they have been dropped.

The impacted functions are:

- Under `cfg(feature = "functions")`: `Connection::create_scalar_function`, `Connection::create_aggregate_function` and `Connection::create_window_function`.
- Under `cfg(feature = "hooks")`: `Connection::commit_hook`, `Connection::rollback_hook` and `Connection::update_hook`.
- Under `cfg(feature = "collation")`: `Connection::create_collation`.

The issue exists in all `0.25.*` versions prior to `0.25.4`, and all `0.26.*` versions prior to 0.26.2 (specifically: `0.25.0`, `0.25.1`, `0.25.2`, `0.25.3`, `0.26.0`, and `0.26.1`).

The fix is available in versions `0.26.2` and newer, and also has been back-ported to `0.25.4`. As it does not exist in `0.24.*`, all affected versions should have an upgrade path to a semver-compatible release.
Vulnerability: GHSA-xp6v-qx65-4pp7
Summary: Data races in gfwx
Aliases: CVE-2020-36211
Severity: HIGH
CWE: CWE-662, CWE-787
Published: 2021-08-25T20:50:39Z

An issue was discovered in the gfwx crate before 0.3.0 for Rust. Because ImageChunkMut does not have bounds on its Send trait or Sync trait, a data race and memory corruption can occur.
Vulnerability: RUSTSEC-2017-0002
Summary: headers containing newline characters can split messages
Aliases: CVE-2017-18587
Published: 2017-01-23T12:00:00Z

Serializing of headers to the socket did not filter the values for newline bytes (`\r` or `\n`),
which allowed for header values to split a request or response. People would not likely include
newlines in the headers in their own applications, so the way for most people to exploit this
is if an application constructs headers based on unsanitized user input.

This issue was fixed by replacing all newline characters with a space during serialization of
a header value.
Vulnerability: RUSTSEC-2020-0026
Summary: linked-hash-map creates uninitialized NonNull pointer
Aliases: CVE-2020-25573
Published: 2020-06-23T12:00:00Z

Affected versions of this crate called `mem::uninitialized()` to create a `NonNull<T>`,
which is undefined behavior.
 
The flaw was corrected by avoiding the use of `mem::uninitialized()`.
Vulnerability: GHSA-6rhx-hqxm-8p36
Summary: Double free in http
Aliases: CVE-2019-25009
Severity: CRITICAL
CWE: CWE-415
Published: 2021-08-25T20:46:44Z

An issue was discovered in the http crate before 0.1.20 for Rust. The HeaderMap::Drain API can use a raw pointer, defeating soundness.
Vulnerability: GHSA-xpwj-7v8q-mcgj
Summary: Static imports inside dynamically imported modules do not adhere to permission checks
Aliases: CVE-2021-32619
Severity: CRITICAL
CWE: CWE-285
Published: 2021-09-23T23:18:03Z

### Impact

Modules that are dynamically imported through `import()` or `new Worker` might have been able to bypass network and file system permission checks when statically importing other modules. In Deno 1.5.x and 1.6.x only programs dynamically importing (especially transitively) untrusted code are affected. In Deno 1.7.x all programs importing (especially transitively) untrusted code are affected.

In effect an attacker in control of a (possibly remote) module in a programs module graph has been able to, **irrespective of permissions**:
1. initiate GET requests to arbitrary URLs on the internet (including LAN) and possibly read (parts of) the contents of these resources.
2. check for existence of arbitrary paths on the file system, and possibly read (parts of) the contents of these files.

In Deno 1.5.x (October 27th, 2020) and Deno 1.6.x (December 8th, 2020) the attacker module had to have been granted permissions to load dynamically through the network / fs read permission. Since Deno 1.7.x (January 19th, 2021) this vulnerability was able to be exploited in a fully sandboxed isolate (without any permissions). This vulnerability was not present in releases prior to 1.5.0.

Arbitrary non-GET requests, control over request headers, or file system writes are not possible through this vulnerability. Users of the `deno_core`, `deno_runtime`, or other `deno_*` crates are not affected. This is a Deno CLI only vulnerability.

We are relatively confident this was not abused in the wild, as by default Deno prints out a green "Download" message when remote imports are downloaded, and this would have caused suspicion if it occurred in the middle of a programs execution. This message can be silenced with the `--quiet` flag.  

### Patches

The vulnerability has been patched in Deno release 1.10.2. You can upgrade to the latest Deno version by running the `deno upgrade` command. The release is available through all official download channels. 

### Workarounds

There is no workaround for this issue.

### For more information

If you have any questions or comments about this advisory:
* Open an issue on [the issue tracker](https://github.com/denoland/deno)
* Discuss on [Discord](https://discord.gg/deno)
Vulnerability: GHSA-vw5m-qw2r-m923
Summary: Use of Uninitialized Resource in messagepack-rs.
Aliases: CVE-2021-45690
Severity: CRITICAL
CWE: CWE-908
Published: 2022-01-06T22:11:46Z

An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_binary may read from uninitialized memory locations.
Vulnerability: RUSTSEC-2020-0134
Summary: `LockWeak<T>` allows to create data race to `T`.
Aliases: CVE-2020-36454
Published: 2020-11-14T12:00:00Z

In the affected versions of this crate, `LockWeak<T>` unconditionally implemented `Send` with no trait bounds on `T`. `LockWeak<T>` doesn't own `T` and only provides `&T`.

This allows concurrent access to a non-Sync `T`, which can cause undefined behavior like data races.
Vulnerability: GHSA-gppw-3h6h-v6q2
Summary: Data race in internment
Aliases: CVE-2021-28037
Severity: CRITICAL
CWE: CWE-362
Published: 2021-08-25T20:52:08Z

An issue was discovered in the internment crate before 0.4.2 for Rust. There is a data race that can cause memory corruption because of the unconditional implementation of Sync for Intern<T>.
Vulnerability: RUSTSEC-2020-0071
Summary: Potential segfault in the time crate
Aliases: CVE-2020-26235
Published: 2020-11-18T12:00:00Z

### Impact

Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.

The affected functions from time 0.2.7 through 0.2.22 are:

- `time::UtcOffset::local_offset_at`
- `time::UtcOffset::try_local_offset_at`
- `time::UtcOffset::current_local_offset`
- `time::UtcOffset::try_current_local_offset`
- `time::OffsetDateTime::now_local`
- `time::OffsetDateTime::try_now_local`

The affected functions in time 0.1 (all versions) are:

- `at`
- `at_utc`
- `now`

Non-Unix targets (including Windows and wasm) are unaffected.

### Patches

Pending a proper fix, the internal method that determines the local offset has been modified to always return `None` on the affected operating systems. This has the effect of returning an `Err` on the `try_*` methods and `UTC` on the non-`try_*` methods.

Users and library authors with time in their dependency tree should perform `cargo update`, which will pull in the updated, unaffected code.

Users of time 0.1 do not have a patch and should upgrade to an unaffected version: time 0.2.23 or greater or the 0.3 series.

### Workarounds

No workarounds are known.

### References

time-rs/time#293
Vulnerability: GHSA-jphw-p3m6-pj3c
Summary: Data races in multiqueue2
Aliases: CVE-2020-36214
Severity: MODERATE
CWE: CWE-662
Published: 2021-08-25T20:51:54Z

An issue was discovered in the multiqueue2 crate before 0.1.7 for Rust. Because a non-Send type can be sent to a different thread, a data race can occur.
Vulnerability: GHSA-gvcp-948f-8f2p
Summary: Use of Uninitialized Resource in libp2p-deflate
Aliases: CVE-2020-36443
Severity: CRITICAL
CWE: CWE-908
Published: 2021-08-25T20:59:04Z

An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust. An uninitialized buffer is passed to AsyncRead::poll_read(), which is a user-provided trait function.
Vulnerability: GHSA-g4h2-4wvh-grc5
Summary: Uncontrolled Resource Consumption in simple_asn1
Aliases: CVE-2021-45711
Severity: HIGH
CWE: CWE-400
Published: 2022-01-06T22:05:05Z

An issue was discovered in the simple_asn1 crate 0.6.0 before 0.6.1 for Rust. There is a panic if UTCTime data, supplied by a remote attacker, has a second character greater than 0x7f.
Vulnerability: RUSTSEC-2020-0122
Summary: beef::Cow lacks a Sync bound on its Send trait allowing for data races
Aliases: CVE-2020-36442
Published: 2020-10-28T12:00:00Z

Affected versions of this crate did not have a `T: Sync` bound in the `Send` impl for `Cow<'_, T, U>`. This allows users to create data races by making `Cow` contain types that are (Send && !Sync) like `Cell<_>` or `RefCell<_>`.

Such data races can lead to memory corruption.

The flaw was corrected in commit d1c7658 by adding trait bounds `T: Sync` and `T::Owned: Send` to the `Send` impl for `Cow<'_, T, U>`.
Vulnerability: RUSTSEC-2020-0088
Summary: MPMCConsumer/Producer allows sending non-Send type across threads
Aliases: CVE-2020-35925
Published: 2020-11-29T12:00:00Z

Affected versions of this crate unconditionally implemented `Sync` and `Send` traits for `MPMCConsumer` and `MPMCProducer` types.

This allows users to send types that do not implement `Send` trait across thread boundaries, which can cause a data race.

The flaw was corrected in the 2.0.1 release by adding `T: Send` bound to affected Sync/Send trait implementations.
Vulnerability: GHSA-9j8q-m9x5-9g6j
Summary: Data races in async-coap
Aliases: CVE-2020-36444
Severity: HIGH
CWE: CWE-119, CWE-362
Published: 2021-08-25T20:59:11Z

An issue was discovered in the async-coap crate through 2020-12-08 for Rust. 
Affected versions of this crate implement Send/Sync for `ArcGuard<RC, T>` with no trait bounds on `RC`. This allows users to send `RC: !Send` to other threads and also allows users to concurrently access `Rc: !Sync` from multiple threads.

This can result in memory corruption from data race or other undefined behavior caused by sending `T: !Send` to other threads (e.g. dropping `MutexGuard<T>` in another thread that didn't lock its mutex).
Vulnerability: RUSTSEC-2020-0067
Summary: crate has been renamed to `qp2p`
Published: 2020-11-02T12:00:00Z

This crate has been renamed from `quic-p2p` to `qp2p`.

The new repository location is:

<https://github.com/maidsafe/qp2p>
Vulnerability: GHSA-w428-f65r-h4q2
Summary: Deserialization of Untrusted Data in rust-cpuid
Aliases: CVE-2021-45687
Severity: CRITICAL
CWE: CWE-502
Published: 2022-01-06T22:13:12Z

An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used (which is not the the default), a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic.
Vulnerability: GHSA-5325-xw5m-phm3
Summary: Cross-site Scripting in ammonia
Aliases: CVE-2021-38193
Severity: MODERATE
CWE: CWE-79
Published: 2021-08-25T20:55:56Z

An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.
Vulnerability: RUSTSEC-2018-0006
Summary: Uncontrolled recursion leads to abort in deserialization
Aliases: CVE-2018-20993
Published: 2018-09-17T12:00:00Z

Affected versions of this crate did not prevent deep recursion while
deserializing data structures.

This allows an attacker to make a YAML file with deeply nested structures
that causes an abort while deserializing it.

The flaw was corrected by checking the recursion depth.

Note: `clap 2.33` is not affected by this because it uses `yaml-rust`
in a way that doesn't trigger the vulnerability. More specifically:

1. The input to the YAML parser is always trusted - is included at compile
time via `include_str!`.

2. The nesting level is never deep enough to trigger the overflow in practice
(at most 5).
Vulnerability: RUSTSEC-2021-0094
Summary: Window can read out of bounds if Read instance returns more bytes than buffer size
Published: 2021-02-03T12:00:00Z

`rdiff` performs a diff of two provided strings or files. As part of its reading
code it uses the return value of a `Read` instance to set the length of
its internal character vector.

If the `Read` implementation claims that it has read more bytes than the length
of the provided buffer, the length of the vector will be set to longer than its
capacity. This causes `rdiff` APIs to return uninitialized memory in its API
methods.
Vulnerability: GHSA-x67x-vg9m-65c3
Summary: Integer overflow in base64
Aliases: CVE-2017-1000430
Severity: CRITICAL
CWE: CWE-119
Published: 2021-08-25T20:55:27Z

Affected versions of this crate suffered from an integer overflow bug when
calculating the size of a buffer to use when encoding base64 using the
`encode_config_buf` and `encode_config` functions.  If the input string
was large, this would cause a buffer to be allocated that was too small.
Since this function writes to the buffer using unsafe code, it would
allow an attacker to write beyond the buffer, causing memory corruption
and possibly the execution of arbitrary code.

This flaw was corrected by using checked arithmetic to calculate
the size of the buffer.
Vulnerability: GHSA-8fgg-5v78-6g76
Summary: Deserializing an array can free uninitialized memory in byte_struct
Aliases: CVE-2021-28033
Severity: CRITICAL
CWE: CWE-908, CWE-119
Published: 2021-08-25T20:52:03Z

Byte_struct stack and unpack structure as raw bytes with packed or bit field layout. An issue was discovered in the byte_struct crate before 0.6.1 for Rust. There can be a drop of uninitialized memory if a certain deserialization method panics.
Vulnerability: GHSA-9mp7-45qh-r8j8
Summary: Use of Uninitialized Resource in columnar.
Aliases: CVE-2021-45685
Severity: CRITICAL
CWE: CWE-908
Published: 2022-01-06T22:13:46Z

An issue was discovered in the columnar crate through 2021-01-07 for Rust. ColumnarReadExt::read_typed_vec may read from uninitialized memory locations.
Vulnerability: GHSA-3w8g-xr3f-2mp8
Summary: Out of bounds write in nalgebra
Aliases: CVE-2021-38190
Severity: CRITICAL
CWE: CWE-787, CWE-119
Published: 2021-08-25T20:55:49Z

The `Deserialize` implementation for `VecStorage` did not maintain the invariant that the number of elements must equal `nrows * ncols`. Deserialization of specially crafted inputs could allow memory access beyond allocation of the vector.

This flaw was introduced in v0.11.0 ([`086e6e`](https://github.com/dimforge/nalgebra/commit/086e6e719f53fecba6dadad2e953a487976387f5)) due to the addition of an automatically derived implementation of `Deserialize` for `MatrixVec`. `MatrixVec` was later renamed to `VecStorage` in v0.16.13 ([`0f66403`](https://github.com/dimforge/nalgebra/commit/0f66403cbbe9eeac15cedd8a906c0d6a3d8841f2)) and continued to use the automatically derived implementation of `Deserialize`.
Vulnerability: RUSTSEC-2020-0030
Summary: Missing sanitazion in mozwire allows local file overwrite of files ending in .conf
Aliases: CVE-2020-35883
Published: 2020-08-18T12:00:00Z

The client software downloaded a list of servers from mozilla's servers and created local files named
after the hostname field in the json document.

No verification of the content of the string was made, and it could therefore have included '../' leading to path traversal.

This allows an attacker in control of mozilla's servers to overwrite/create local files named .conf.

The flaw was corrected by sanitizing the hostname field.
Vulnerability: RUSTSEC-2019-0036
Summary: Type confusion if __private_get_type_id__ is overridden
Aliases: CVE-2019-25010, CVE-2020-25575
Published: 2019-11-13T12:00:00Z

Safe Rust code can implement malfunctioning `__private_get_type_id__` and cause
type confusion when downcasting, which is an undefined behavior.

Users who derive `Fail` trait are not affected.
Vulnerability: GHSA-8hfj-xrj2-pm22
Summary: Certificate check bypass in openssl-src
Aliases: CVE-2021-3450
Severity: HIGH
CWE: CWE-295
Published: 2021-08-25T20:54:00Z

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named "purpose" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j).
Vulnerability: GHSA-jq65-29v4-4x35
Summary: Null pointer deference in openssl-src 
Aliases: CVE-2020-1967
Severity: HIGH
CWE: CWE-476
Published: 2021-08-25T20:45:15Z

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).
Vulnerability: GHSA-mp6r-fgw2-rxfx
Summary: Multiple soundness issues
Aliases: CVE-2021-26956
Severity: CRITICAL
CWE: CWE-657
Published: 2021-08-25T20:53:27Z

An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because bytes from an X server can be interpreted as any data type returned by xcb::xproto::GetPropertyReply::value.
Vulnerability: RUSTSEC-2021-0112
Summary: `Read` on uninitialized buffer may cause UB ('tectonic_xdv' crate)
Published: 2021-02-17T12:00:00Z

Affected versions of this crate passes an uninitialized buffer to a user-provided `Read` implementation.

Arbitrary `Read` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.

The problem was fixed in commit `cdff034` by zero-initializing the buffer before passing it to a user-provided `Read` implementation.
Vulnerability: GHSA-369h-pjr2-6wrh
Summary: Uncontrolled recursion in trust-dns-proto
Aliases: CVE-2018-20994
Severity: HIGH
CWE: CWE-674
Published: 2021-08-25T20:43:16Z

An issue was discovered in the trust-dns-proto crate before 0.5.0-alpha.3 for Rust. There is infinite recursion because DNS message compression is mishandled.
Vulnerability: RUSTSEC-2021-0057
Summary: Integer overflow in CipherUpdate
Aliases: CVE-2021-23840
Published: 2021-05-01T12:00:00Z

Calls to `EVP_CipherUpdate`, `EVP_EncryptUpdate` and `EVP_DecryptUpdate` may overflow
the output length argument in some cases where the input length is close to the
maximum permissable length for an integer on the platform. In such cases the
return value from the function call will be 1 (indicating success), but the
output length value will be negative. This could cause applications to behave
incorrectly or crash.
Vulnerability: RUSTSEC-2022-0002
Summary: Unsoundness in `dashmap` references
Published: 2022-01-10T12:00:00Z

Reference returned by some methods of `Ref` (and similar types) may outlive the `Ref` and escape the lock.
This causes undefined behavior and may result in a segfault.

More information in [`dashmap#167`](https://github.com/xacrimon/dashmap/issues/167) issue.
Vulnerability: RUSTSEC-2020-0159
Summary: Potential segfault in `localtime_r` invocations
Published: 2020-11-10T12:00:00Z

### Impact

Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.

### Workarounds

No workarounds are known.

### References

- [time-rs/time#293](https://github.com/time-rs/time/issues/293)
Vulnerability: GHSA-w9vv-q986-vj7x
Summary: Out of bounds read in uu_od
Aliases: CVE-2021-29934
Severity: HIGH
CWE: CWE-125
Published: 2021-08-25T20:54:24Z

An issue was discovered in PartialReader in the uu_od crate before 0.0.4 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation.
Vulnerability: RUSTSEC-2021-0104
Summary: File exposure in pleaser
Aliases: CVE-2021-31153, GHSA-f3fg-5j9p-vchc
Published: 2021-05-27T12:00:00Z

pleaser before 0.4 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.
Vulnerability: GHSA-jrf8-cmgg-gv2m
Summary: Error on unsupported architectures in raw-cpuid
Aliases: CVE-2021-26307
Severity: MODERATE
CWE: CWE-657
Published: 2021-08-25T20:53:07Z

An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust. It allows __cpuid_count() calls even if the processor does not support the CPUID instruction, which is unsound and causes a deterministic crash.
Vulnerability: GHSA-8rc5-mr4f-m243
Summary: Use after free in rio
Aliases: CVE-2020-35876
Severity: CRITICAL
CWE: CWE-772, CWE-416
Published: 2021-08-25T20:46:57Z

An issue was discovered in the rio crate through 2020-05-11 for Rust. A struct can be leaked, allowing attackers to obtain sensitive information, cause a use-after-free, or cause a data race.
Vulnerability: RUSTSEC-2022-0014
Summary: Infinite loop in `BN_mod_sqrt()` reachable when parsing certificates
Aliases: CVE-2022-0778
Published: 2022-03-15T12:00:00Z

The `BN_mod_sqrt()` function, which computes a modular square root, contains
a bug that can cause it to loop forever for non-prime moduli.

Internally this function is used when parsing certificates that contain
elliptic curve public keys in compressed form or explicit elliptic curve
parameters with a base point encoded in compressed form.

It is possible to trigger the infinite loop by crafting a certificate that
has invalid explicit curve parameters.

Since certificate parsing happens prior to verification of the certificate
signature, any process that parses an externally supplied certificate may thus
be subject to a denial of service attack. The infinite loop can also be
reached when parsing crafted private keys as they can contain explicit
elliptic curve parameters.

Thus vulnerable situations include:

 - TLS clients consuming server certificates
 - TLS servers consuming client certificates
 - Hosting providers taking certificates or private keys from customers
 - Certificate authorities parsing certification requests from subscribers
 - Anything else which parses ASN.1 elliptic curve parameters

Also any other applications that use the `BN_mod_sqrt()` where the attacker
can control the parameter values are vulnerable to this DoS issue.
Vulnerability: RUSTSEC-2021-0041
Summary: Denial of service through parsing payloads with too big exponent
Aliases: CVE-2021-29932, CAN-2021-1000007
Published: 2021-03-18T12:00:00Z

The `parse_duration::parse` function allows for parsing duration strings with exponents like `5e5s` where under the hood, the [`BigInt` type along with the `pow` function are used for such payloads](https://github.com/zeta12ti/parse_duration/blob/26940ab5cd4e3a9d6bd97aa101f8d4bbfd18ee8c/src/parse.rs#L335). Passing an arbitrarily big exponent makes the `parse_duration::parse` function to process the payload for a very long time taking up CPU and memory.

This allows an attacker to cause a DoS if the `parse_duration::parse` function is used to process untrusted input.
Vulnerability: GHSA-m5pq-gvj9-9vr8
Summary: Regular expression denial of service in Rust's regex crate
Aliases: CVE-2022-24713
Severity: HIGH
CWE: CWE-400
Published: 2022-03-08T20:00:36Z

> This is a cross-post of [the official security advisory][advisory]. The official advisory contains a signed version with our PGP key, as well.

[advisory]: https://groups.google.com/g/rustlang-security-announcements/c/NcNNL1Jq7Yw

The Rust Security Response WG was notified that the `regex` crate did not properly limit the complexity of the regular expressions (regex) it parses. An attacker could use this security issue to perform a denial of service, by sending a specially crafted regex to a service accepting untrusted regexes. No known vulnerability is present when parsing untrusted input with trusted regexes.

This issue has been assigned CVE-2022-24713. The severity of this vulnerability is "high" when the `regex` crate is used to parse untrusted regexes. Other uses of the `regex` crate are not affected by this vulnerability.

## Overview

The `regex` crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it's considered part of the crate's API.

Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing, and it's possible to craft regexes that bypass such mitigations. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted regexes.

## Affected versions

All versions of the `regex` crate before or equal to 1.5.4 are affected by this issue. The fix is include starting from  `regex` 1.5.5.

## Mitigations

We recommend everyone accepting user-controlled regexes to upgrade immediately to the latest version of the `regex` crate.

Unfortunately there is no fixed set of problematic regexes, as there are practically infinite regexes that could be crafted to exploit this vulnerability. Because of this, we do not recommend denying known problematic regexes.

## Acknowledgements

We want to thank Addison Crump for responsibly disclosing this to us according to the [Rust security policy](https://www.rust-lang.org/policies/security), and for helping review the fix.

We also want to thank Andrew Gallant for developing the fix, and Pietro Albini for coordinating the disclosure and writing this advisory.
Vulnerability: RUSTSEC-2021-0016
Summary: `IoReader::read()`: user-provided `Read` on uninitialized buffer may cause UB
Aliases: CVE-2021-26952
Published: 2021-01-26T12:00:00Z

Affected versions of this crate passes an uninitialized buffer to a user-provided `Read` implementation.

Arbitrary `Read` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer.
Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.

The flaw was fixed in commit 599313b by zero-initializing the buffer (via `self.buf.resize(len, 0)`) before passing it to `Read`.
Vulnerability: GHSA-vqx7-pw4r-29rr
Summary: Out of bounds read in bumpalo
Aliases: CVE-2020-35861
Severity: HIGH
CWE: CWE-125
Published: 2021-08-25T20:47:13Z

An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys.
Vulnerability: GHSA-rqgx-hpg4-456r
Summary: Use-after-free in actix-codec
Aliases: CVE-2020-35902
Severity: CRITICAL
CWE: CWE-416
Published: 2021-08-25T20:49:45Z

An issue was discovered in the actix-codec crate before 0.3.0-beta.1 for Rust. There is a use-after-free in Framed.
Vulnerability: RUSTSEC-2019-0020
Summary: fix unsound APIs that could lead to UB
Aliases: CVE-2019-16144
Published: 2019-09-06T12:00:00Z

Affected versions of this crate API could use uninitialized memory with some APIs in special
cases, like use the API in none generator context. This could lead to UB.
The flaw was corrected by <https://github.com/Xudong-Huang/generator-rs/issues/9>
                          <https://github.com/Xudong-Huang/generator-rs/issues/11>
                          <https://github.com/Xudong-Huang/generator-rs/issues/13>
                          <https://github.com/Xudong-Huang/generator-rs/issues/14>                                                  
This patch fixes all those issues above.
Vulnerability: RUSTSEC-2020-0118
Summary: Future<T> lacks bounds on Send and Sync.
Aliases: CVE-2020-36438
Published: 2020-12-08T12:00:00Z

`tiny_future` contains a light-weight implementation of `Future`s. The `Future`
type it has lacked bound on its `Send` and `Sync` traits.

This allows for a bug where non-thread safe types such as `Cell` can be used in
`Future`s and cause data races in concurrent programs.

The flaw was corrected in commit `c791919` by adding trait bounds to `Future`'s
`Send` and `Sync`.
Vulnerability: GHSA-3cgf-9m6x-pwwr
Summary: Data races in rusqlite
Aliases: CVE-2020-35868
Severity: CRITICAL
CWE: CWE-362
Published: 2021-08-25T20:47:50Z

An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via UnlockNotification.
Vulnerability: RUSTSEC-2020-0056
Summary: stdweb is unmaintained
Published: 2020-05-04T12:00:00Z

The author of the `stdweb` crate is unresponsive.

Maintained alternatives:

- [`wasm-bindgen`](https://github.com/rustwasm/wasm-bindgen)
- [`js-sys`](https://github.com/rustwasm/wasm-bindgen/tree/master/crates/js-sys)
- [`web-sys`](https://github.com/rustwasm/wasm-bindgen/tree/master/crates/web-sys)
Vulnerability: GHSA-3mf3-2gv9-h39j
Summary: Uninitialized buffer use in marc
Aliases: CVE-2021-26308
Severity: HIGH
CWE: CWE-908
Published: 2021-08-25T20:53:14Z

An issue was discovered in the marc crate before 2.0.0 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated memory, violating soundness.
Vulnerability: RUSTSEC-2020-0113
Summary: AtomicOption should have Send + Sync bound on its type argument.
Aliases: CVE-2020-36219
Published: 2020-10-31T12:00:00Z

In the affected versions of this crate,
`AtomicOption<T>` unconditionally implements `Sync`.

This allows programmers to move non-Sync types across thread boundaries (e.g. `Rc<T>`, `Arc<Cell<T>>`), which can lead to data races and undefined behavior. 
It is also possible to send non-Send types like `std::sync::MutexGuard` to other threads, which can lead to undefined behavior.
Vulnerability: GHSA-6wp2-fw3v-mfmc
Summary: Memory corruption in array-tools
Aliases: CVE-2020-36452
Severity: CRITICAL
CWE: CWE-908, CWE-909
Published: 2021-08-25T20:57:19Z

An issue was discovered in the array-tools crate before 0.3.2 for Rust. Affected versions of this crate don't guard against panics, so that partially uninitialized buffer is dropped when user-provided `T::clone()` panics in `FixedCapacityDequeLike<T, A>::clone()`. This causes memory corruption.
Vulnerability: GHSA-w65j-g6c7-g3m4
Summary: Multiple memory safety issues in actix-web
Severity: MODERATE
CWE: CWE-362
Published: 2021-08-25T20:42:50Z

Affected versions contain multiple memory safety issues, such as:

 - Unsoundly coercing immutable references to mutable references
 - Unsoundly extending lifetimes of strings
 - Adding the `Send` marker trait to objects that cannot be safely sent between threads

This may result in a variety of memory corruption scenarios, most likely use-after-free.
 
A signficant refactoring effort has been conducted to resolve these issues.
Vulnerability: RUSTSEC-2020-0001
Summary: Stack overflow when resolving additional records from MX or SRV null targets
Aliases: CVE-2020-35857
Published: 2020-01-06T12:00:00Z

There's a stack overflow leading to a crash and potential DOS when processing
additional records for return of MX or SRV record types from the server.

This is only possible when a zone is configured with a null target for MX or SRV records, i.e. '.'.

Example effected zone record:
```text
no-service 86400 IN MX 0 .
```

Prior to 0.16.0 the additional record processing was not supported by trust-dns-server. There
Are no known issues with upgrading from 0.16 or 0.17 to 0.18.1. The remidy should be to upgrade to
0.18.1. If unable to do so, MX, SRV or other record types with a target to the null type, should be avoided.
Vulnerability: RUSTSEC-2020-0144
Summary: lzw is unmaintained
Published: 2020-02-10T12:00:00Z

The author of the `lzw` crate is unresponsive.

Maintained alternatives:

- [`weezl`](https://crates.io/crates/weezl)
Vulnerability: GHSA-5hpj-m323-cphm
Summary: Double free in through
Aliases: CVE-2021-29940
Severity: CRITICAL
CWE: CWE-415
Published: 2021-08-25T20:54:12Z

An issue was discovered in the through crate through 2021-02-18 for Rust. There is a double free (in through and through_and) upon a panic of the map function.
Vulnerability: RUSTSEC-2021-0119
Summary: Out-of-bounds write in nix::unistd::getgrouplist
Published: 2021-09-27T12:00:00Z

On certain platforms, if a user has more than 16 groups, the
`nix::unistd::getgrouplist` function will call the libc `getgrouplist`
function with a length parameter greater than the size of the buffer it
provides, resulting in an out-of-bounds write and memory corruption.

The libc `getgrouplist` function takes an in/out parameter `ngroups`
specifying the size of the group buffer. When the buffer is too small to
hold all of the reqested user's group memberships, some libc
implementations, including glibc and Solaris libc, will modify `ngroups`
to indicate the actual number of groups for the user, in addition to
returning an error. The version of `nix::unistd::getgrouplist` in nix
0.16.0 and up will resize the buffer to twice its size, but will not
read or modify the `ngroups` variable. Thus, if the user has more than
twice as many groups as the initial buffer size of 8, the next call to
`getgrouplist` will then write past the end of the buffer.

The issue would require editing /etc/groups to exploit, which is usually
only editable by the root user.
Vulnerability: RUSTSEC-2022-0009
Summary: Failure to verify the public key of a `SignedEnvelope` against the `PeerId` in a `PeerRecord`
Published: 2022-02-07T12:00:00Z

Affected versions of this crate did not check that the public key the signature was created with matches the peer ID of the peer record. 
Any combination was considered valid.

This allows an attacker to republish an existing `PeerRecord` with a different `PeerId`.
Vulnerability: RUSTSEC-2018-0021
Summary: Use-after-free with objects returned by `Stream`'s `get_format_info` and `get_context` methods
Aliases: GHSA-ghpq-vjxw-ch5w
Published: 2018-06-15T12:00:00Z

Affected versions contained a pair of use-after-free issues with the objects returned by the `get_format_info` and `get_context` methods of `Stream` objects. These objects were mistakenly being constructed without setting an important flag to prevent destruction of the underlying C objects they reference upon their own destruction.
Vulnerability: GHSA-327x-39hh-65wf
Summary: Out of bounds write in arenavec
Aliases: CVE-2021-29930
Severity: HIGH
CWE: CWE-787
Published: 2021-08-25T20:55:09Z

An issue was discovered in the arenavec crate through 0.1.1. A drop of uninitialized memory can sometimes occur upon a panic in T::default().
Vulnerability: GHSA-h6xw-mghq-7523
Summary: Unsafe parsing in SWHKD
Aliases: CVE-2022-27819
Severity: MODERATE
CWE: CWE-400
Published: 2022-04-08T00:00:24Z

SWHKD 1.1.5 allows unsafe parsing via the -c option. An information leak might occur but there is a simple denial of service (memory exhaustion) upon an attempt to parse a large or infinite file (such as a block or character device).
Vulnerability: GHSA-6p3c-v8vc-c244
Summary: The `total_size` function for partial read the length of any `FixVec` is incorrect in molecule.
Aliases: CVE-2021-45697
Severity: CRITICAL
Published: 2022-01-06T22:10:34Z

An issue was discovered in the molecule crate before 0.7.2 for Rust. A FixVec partial read has an incorrect result.
Vulnerability: GHSA-3hj2-hh36-hv9v
Summary: Data race in va-ts
Aliases: CVE-2020-36220
Severity: MODERATE
CWE: CWE-667, CWE-662, CWE-787
Published: 2021-08-25T20:51:56Z

An issue was discovered in the va-ts crate before 0.0.4 for Rust. Because Demuxer<T> omits a required T: Send bound, a data race and memory corruption can occur.
Vulnerability: RUSTSEC-2020-0017
Summary: Use after free in ArcIntern::drop
Aliases: CVE-2020-35874
Published: 2020-05-28T12:00:00Z

`ArcIntern::drop` has a race condition where it can release memory
which is about to get another user. The new user will get a reference
to freed memory.

This was fixed by serializing access to an interned object while it
is being deallocated.

Versions prior to 0.3.12 used stronger locking which avoided the problem.
Vulnerability: GHSA-4vr9-8cjf-vf9c
Summary: Async-h1 request smuggling possible with long unread bodies
Aliases: CVE-2020-26281
Severity: MODERATE
CWE: CWE-444
Published: 2021-10-12T16:00:37Z

### Impact
This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications.

If the server does not read the body of a request which is longer than some buffer length, async-h1 will attempt to read a subsequent request from the body content starting at that offset into the body.

One way to exploit this vulnerability would be for an adversary to craft a request such that the body contains a request that would not be noticed by a reverse proxy, allowing it to forge forwarded/x-forwarded headers. If an application trusted the authenticity of these headers, it could be misled by the smuggled request.

Another potential concern with this vulnerability is that if a reverse proxy is sending multiple http clients' requests along the same keep-alive connection, it would be possible for the smuggled request to specify a long content and capture another user's request in its body. This content could be captured in a post request to an endpoint that allows the content to be subsequently retrieved by the adversary.


### Patches
This has been addressed in async-h1 2.3.0 and previous versions have been yanked.

### Workarounds
none

### References
https://github.com/http-rs/async-h1/releases/tag/v2.3.0

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [async-h1](https://github.com/http-rs/async-h1)
* Contact a core team member on [zulip](https://http-rs.zulip-chat.com) or [discord](https://discord.gg/x2gKzst)
Vulnerability: GHSA-4q4x-67hx-5mpg
Summary: Failure to properly verify ed25519 signatures in libp2p-core
Aliases: CVE-2019-15545
Severity: HIGH
CWE: CWE-347
Published: 2021-08-25T20:44:08Z

An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Attackers can spoof ed25519 signatures.
Vulnerability: RUSTSEC-2020-0152
Summary: ImmediateIO and TransactionalIO can cause data races
Aliases: CVE-2020-36472
Published: 2020-12-18T12:00:00Z

The `ImmediateIO` and `TransactionalIO` types implement `Sync` for all contained
`Expander<EI>` types regardless of if the `Expander` itself is safe to use
across threads.

As the `IO` types allow retrieving the `Expander`, this can lead to non-thread
safe types being sent across threads as part of the `Expander` leading to data
races.
Vulnerability: GHSA-j42v-6wpm-r847
Summary: Data races in thex
Aliases: CVE-2020-35927
Severity: MODERATE
CWE: CWE-662
Published: 2021-08-25T20:50:26Z

An issue was discovered in the thex crate through 2020-12-08 for Rust. Thex<T> allows cross-thread data races of non-Send types.