deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-q3gg-m8hr-h4x4
Package: surrealdb (RUST)
Severity: HIGH (CVSS 8.5)
Vulnerable versions: < 1.1.1
Patched in: 1.1.1

Summary: Externally Controlled Format String in Scripting Functions

Details:
The `rquickjs` crate used by SurrealDB implements Rust bindings to the QuickJS C library and is used to execute SurrealDB scripting functions. The `rquickjs` function `Exception::throw_type` takes a string and returns an error object. Prior to version `0.4.2` of the crate, this string would be fed directly into `printf`, which will receive the error string as a format string with no additional arguments, leading to undefined behavior. This issue triggers when a SurrealDB scripting function returns an error and its input contains a format string such as `%s` or `%d`. 

This vulnerability can only affect SurrealDB servers explicitly enabling the scripting capability with `--allow-scripting` or `--allow-all` and equivalent environment variables `SURREAL_CAPS_ALLOW_SCRIPT=true` and `SURREAL_CAPS_ALLOW_ALL=true`.

### Impact

An attacker with privileges to execute scripting functions with arbitrary inputs may be able to exploit this format string vulnerability in order read arbitrary memory from the remote SurrealDB process. A format string vulnerability may also be further exploited to execute arbitrary code with the privileges of the SurrealDB process.

The fact that error messages are limited to 256 bytes coupled with [exploit mitigation features supported in Rust executables](https://doc.rust-lang.org/rustc/exploit-mitigations.html#exploit-mitigations-1) may somewhat increase the complexity of exploiting this vulnerability to reliably achieve remote code execution in practice.

### Patches

- Version 1.1.1 and later are not affected by this issue.

### Workarounds

Users unable to update should restrict access from untrusted users to define and execute scripting functions. This can be achieved by removing the scripting capability by default or with `--deny-scripting` and equivalent environment variable `SURREAL_CAPS_DENY_SCRIPT=true`. If not possible, network access should be limited to trusted users.

### References

- https://github.com/surrealdb/surrealdb/issues/3327
- https://github.com/surrealdb/surrealdb/pull/3332
- https://github.com/DelSkayn/rquickjs/pull/247
GitHub Security Advisory: GHSA-6wr5-jmpr-mjcx
Package: surrealdb (RUST)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-248: Uncaught Exception
Vulnerable versions: <= 1.1.1
Patched in: 1.2.0

Summary: Uncaught Exception in Macro Expecting Native Function to Exist

Details:
The query executor would panic when executing a query containing a call to a built-in SurrealDB function that did not exist. This could occur accidentally in situations where the version of the SurrealDB client was newer than the SurrealDB server or when a pre-parsed query was provided to the server via a newer version of the SurrealDB SDK.

### Impact

A client that is authorized to run queries in a SurrealDB server is able to craft and execute a pre-parsed query invoking a nonexistent built-in function, which will cause a panic. This will crash the server, leading to denial of service.

### Patches

- Version 1.2.0 and later are not affected by this issue.

### Workarounds

Concerned users unable to update may want to limit the ability of untrusted users to run arbitrary SurrealQL queries in the affected versions of SurrealDB. To limit the impact of the denial of service, SurrealDB administrators may also want to ensure that the SurrealDB process is running so that it can be automatically re-started after a crash.

### References

- #3454
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65755
GitHub Security Advisory: GHSA-8xff-473h-f863
Package: surrealdb (RUST)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-248: Uncaught Exception
Vulnerable versions: <= 1.2.0
Patched in: 1.2.1

Summary: Uncaught Exception Handling Parsing Errors on Line Terminators

Details:
The span rendering would panic when handling failed parsing of queries where the error occurred on a line terminator character.

### Impact

A client that is authorized to run queries in a SurrealDB server is able to execute a malformed query which will fail to parse on a line terminator character and cause a panic in the span rendering code. This will crash the server, leading to denial of service.

### Patches

- Version 1.2.1 and later are not affected by this issue.

### Workarounds

Concerned users unable to update may want to limit the ability of untrusted users to run arbitrary SurrealQL queries in the affected versions of SurrealDB. To limit the impact of the denial of service, SurrealDB administrators may also want to ensure that the SurrealDB process is running so that it can be automatically re-started after a crash.

### References

- #3527
- https://github.com/StarlaneStudios/Surrealist/issues/177
GitHub Security Advisory: GHSA-g98v-hv3f-hcfr
Package: atty (RUST)
Severity: LOW (CVSS 0.0)
Vulnerable versions: <= 0.2.14
Patched in: unpatched

Summary: atty potential unaligned read

Details:
On windows, `atty` dereferences a potentially unaligned pointer.

In practice however, the pointer won't be unaligned unless a custom global allocator is used.

In particular, the `System` allocator on windows uses `HeapAlloc`, which guarantees a large enough alignment.

# atty is Unmaintained

A Pull Request with a fix has been provided over a year ago but the maintainer seems to be unreachable.

Last release of `atty` was almost 3 years ago.

## Possible Alternative(s)

The below list has not been vetted in any way and may or may not contain alternatives;

- [std::io::IsTerminal](https://doc.rust-lang.org/stable/std/io/trait.IsTerminal.html) - Stable since Rust 1.70.0
- [is-terminal](https://crates.io/crates/is-terminal) - Standalone crate supporting Rust older than 1.70.0"
GitHub Security Advisory: GHSA-747x-5m58-mq97
Package: svix (RUST)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-288: Authentication Bypass Using an Alternate Path or Channel, CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: < 1.17.0
Patched in: 1.17.0

Summary: svix vulnerable to Authentication Bypass

Details:
Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of the actual signature.

**Note:**

The attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues.
GitHub Security Advisory: GHSA-458v-4hrf-g3m4
Package: net2 (RUST)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-188: Reliance on Data/Memory Layout
Vulnerable versions: < 0.2.36
Patched in: 0.2.36

Summary: socket2 invalidly assumes the memory layout of std::net::SocketAddr

Details:
The socket2 crate has assumed `std::net::SocketAddrV4` and `std::net::SocketAddrV6` have the same memory layout as the system C representation `sockaddr`. It has simply casted the pointers to convert the socket addresses to the system representation. The standard library does not say anything about the memory layout, and this will cause invalid memory access if the standard library changes the implementation. No warnings or errors will be emitted once the change happens.
GitHub Security Advisory: GHSA-458v-4hrf-g3m4
Package: socket2 (RUST)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-188: Reliance on Data/Memory Layout
Vulnerable versions: < 0.3.16
Patched in: 0.3.16

Summary: socket2 invalidly assumes the memory layout of std::net::SocketAddr

Details:
The socket2 crate has assumed `std::net::SocketAddrV4` and `std::net::SocketAddrV6` have the same memory layout as the system C representation `sockaddr`. It has simply casted the pointers to convert the socket addresses to the system representation. The standard library does not say anything about the memory layout, and this will cause invalid memory access if the standard library changes the implementation. No warnings or errors will be emitted once the change happens.
GitHub Security Advisory: GHSA-6gvc-4jvj-pwq4
Package: libpulse-binding (RUST)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-416: Use After Free
Vulnerable versions: >= 1.0.5, < 2.5.0
Patched in: 2.5.0

Summary: Duplicate Advisory: Use after free in libpulse-binding

Details:
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-f56g-chqp-22m9. This link is maintained to preserve external references.

## Original Description
An issue was discovered in the libpulse-binding crate before 2.5.0 for Rust. proplist::Iterator can cause a use-after-free.
GitHub Security Advisory: GHSA-22q8-ghmq-63vf
Package: libgit2-sys (RUST)
Severity: HIGH (CVSS 8.6)
Vulnerable versions: < 0.16.2
Patched in: 0.16.2

Summary: libgit2-sys affected by memory corruption, denial of service, and arbitrary code execution in libgit2

Details:
The [libgit2](https://github.com/libgit2/libgit2/) project fixed three security issues in the 1.7.2 release. These issues are:

* The `git_revparse_single` function can potentially enter an infinite loop on a well-crafted input, potentially causing a Denial of Service. This function is exposed in the `git2` crate via the [`Repository::revparse_single`](https://docs.rs/git2/latest/git2/struct.Repository.html#method.revparse_single) method.
* The `git_index_add` function may cause heap corruption and possibly lead to arbitrary code execution. This function is exposed in the `git2` crate via the [`Index::add`](https://docs.rs/git2/latest/git2/struct.Index.html#method.add) method.
* The smart transport negotiation may experience an out-of-bounds read when a remote server did not advertise capabilities.

The `libgit2-sys` crate bundles libgit2, or optionally links to a system libgit2 library. In either case, versions of the libgit2 library less than 1.7.2 are vulnerable. The 0.16.2 release of `libgit2-sys` bundles the fixed version of 1.7.2, and requires a system libgit2 version of at least 1.7.2.

It is recommended that all users upgrade.
GitHub Security Advisory: GHSA-x5j2-g63m-f8g4
Package: pqc_kyber (RUST)
Severity: HIGH (CVSS 7.4)
Vulnerable versions: <= 0.7.1
Patched in: unpatched

Summary: pqc_kyber KyberSlash: division timings depending on secrets

Details:
Various Kyber software libraries in various environments leak secret information into timing, specifically because

 * these libraries include a line of code that divides a secret numerator by a public denominator,
 * the number of CPU cycles for division in various environments varies depending on the inputs to the division, and
 * this variation appears within the range of numerators used in these libraries.

The KyberSlash pages track which Kyber [libraries](https://kyberslash.cr.yp.to/libraries.html) have this issue, and include a [FAQ](https://kyberslash.cr.yp.to/faq.html) about the issue.

## Author

The KyberSlash pages were written by Daniel J. Bernstein. The FAQ originally said "I", but some people seemed to have trouble finding this authorship statement, so the FAQ now says "Bernstein" instead.

## URL

The permanent link for the KyberSlash pages is [https://kyberslash.cr.yp.to](https://kyberslash.cr.yp.to).

## Mitigation status in pqc_kyber crate

The issues has not been resolved in the `pqc_kyber` crate. A third-party fork that mitigates this attack vector has been published as [`safe_pqc_kyber`](https://crates.io/crates/safe_pqc_kyber).
GitHub Security Advisory: GHSA-rr69-rxr6-8qwf
Package: serde-json-wasm (RUST)
Severity: HIGH (CVSS 7.5)
Vulnerable versions: < 0.5.2
Patched in: 0.5.2

Summary: serde-json-wasm stack overflow during recursive JSON parsing

Details:
When parsing untrusted, deeply nested JSON, the stack may overflow, possibly enabling a Denial of Service attack. This was fixed by adding a check for recursion depth.
GitHub Security Advisory: GHSA-rr69-rxr6-8qwf
Package: serde-json-wasm (RUST)
Severity: HIGH (CVSS 7.5)
Vulnerable versions: = 1.0.0
Patched in: 1.0.1

Summary: serde-json-wasm stack overflow during recursive JSON parsing

Details:
When parsing untrusted, deeply nested JSON, the stack may overflow, possibly enabling a Denial of Service attack. This was fixed by adding a check for recursion depth.
GitHub Security Advisory: GHSA-3qx3-6hxr-j2ch
Package: eza (RUST)
Severity: HIGH (CVSS 8.4)
Vulnerable versions: < 0.18.2
Patched in: 0.18.2

Summary: eza Potential Heap Overflow Vulnerability for AArch64

Details:
### Summary
In `eza`, there exists a potential heap overflow vulnerability, first seen when using Ubuntu for Raspberry Pi series system, on `ubuntu-raspi` kernel, relating to the `.git` directory.

### Details
The vulnerability seems to be triggered by the `.git` directory in some projects. This issue may be related to specific files, and the directory structure also plays a role in triggering the vulnerability. Files/folders that may be involved in triggering the vulnerability include `.git/HEAD`, `.git/refs`, and `.git/objects`.

As @polly pointed out to me, this is likely caused by [GHSA-j2v7-4f6v-gpg8](https://github.com/libgit2/libgit2/security/advisories/GHSA-j2v7-4f6v-gpg8), which we do seem to use currently.

### PoC
For more information check @CuB3y0nd's blogpost [blog](https://www.cubeyond.net/blog/eza-cve-report).

### Impact
Arbitrary code execution.
GitHub Security Advisory: GHSA-w277-wpqf-rcfv
Package: svix (RUST)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 1.17.0
Patched in: 1.17.0

Summary: Duplicate Advisory: Svix vulnerable to improper comparison of different-length signatures

Details:
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-747x-5m58-mq97. This link is maintained to preserve external references.

## Original Description
The `Webhook::verify` function incorrectly compared signatures of different lengths - the two signatures would only be compared up to the length of the shorter signature. This allowed an attacker to pass in `v1,` as the signature, which would always pass verification.
GitHub Security Advisory: GHSA-4f63-89w9-3jjv
Package: openssl-src (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-476: NULL Pointer Dereference
Vulnerable versions: >= 300.0.0, < 300.0.10
Patched in: 300.0.10

Summary: Using a Custom Cipher with `NID_undef` may lead to NULL encryption

Details:
OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to implement custom ciphers. OpenSSL versions 3.0.0 to 3.0.5 incorrectly handle legacy custom ciphers passed to the EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() and EVP_CipherInit_ex2() functions (as well as other similarly named encryption and decryption initialisation functions). Instead of using the custom cipher directly it incorrectly tries to fetch an equivalent cipher from the available providers. An equivalent cipher is found based on the NID passed to EVP_CIPHER_meth_new(). This NID is supposed to represent the unique NID for a given cipher. However it is possible for an application to incorrectly pass NID_undef as this value in the call to EVP_CIPHER_meth_new(). When NID_undef is used in this way the OpenSSL encryption/decryption initialisation function will match the NULL cipher as being equivalent and will fetch this from the available providers. This will succeed if the default provider has been loaded (or if a third party provider has been loaded that offers this cipher). Using the NULL cipher means that the plaintext is emitted as the ciphertext. Applications are only affected by this issue if they call EVP_CIPHER_meth_new() using NID_undef and subsequently use it in a call to an encryption/decryption initialisation function. Applications that only use SSL/TLS are not impacted by this issue. Fixed in OpenSSL 3.0.6 (Affected 3.0.0-3.0.5).
GitHub Security Advisory: GHSA-29c2-65rj-h343
Package: ckb (RUST)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 0.38.0-rc1, < 0.38.2
Patched in: 0.38.2

Summary: Nervos CKB Permit load cell data from memory

Details:
### Impact

The faulty nodes will reject transactions which calls `load_cell_data` syscall but the input cell is still in the mempool. They also ban other nodes and cause the network separation.

### Patches

0.35.2, 0.36.1, 0.37.1, 0.38.2
GitHub Security Advisory: GHSA-29c2-65rj-h343
Package: ckb (RUST)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 0.37.0-rc1, < 0.37.1
Patched in: 0.37.1

Summary: Nervos CKB Permit load cell data from memory

Details:
### Impact

The faulty nodes will reject transactions which calls `load_cell_data` syscall but the input cell is still in the mempool. They also ban other nodes and cause the network separation.

### Patches

0.35.2, 0.36.1, 0.37.1, 0.38.2
GitHub Security Advisory: GHSA-29c2-65rj-h343
Package: ckb (RUST)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 0.36.0-rc1, < 0.36.1
Patched in: 0.36.1

Summary: Nervos CKB Permit load cell data from memory

Details:
### Impact

The faulty nodes will reject transactions which calls `load_cell_data` syscall but the input cell is still in the mempool. They also ban other nodes and cause the network separation.

### Patches

0.35.2, 0.36.1, 0.37.1, 0.38.2
GitHub Security Advisory: GHSA-29c2-65rj-h343
Package: ckb (RUST)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 0.35.0-rc1, < 0.35.2
Patched in: 0.35.2

Summary: Nervos CKB Permit load cell data from memory

Details:
### Impact

The faulty nodes will reject transactions which calls `load_cell_data` syscall but the input cell is still in the mempool. They also ban other nodes and cause the network separation.

### Patches

0.35.2, 0.36.1, 0.37.1, 0.38.2
GitHub Security Advisory: GHSA-29c2-65rj-h343
Package: ckb (RUST)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 0.39.0-rc1, < 0.39.0
Patched in: 0.39.0

Summary: Nervos CKB Permit load cell data from memory

Details:
### Impact

The faulty nodes will reject transactions which calls `load_cell_data` syscall but the input cell is still in the mempool. They also ban other nodes and cause the network separation.

### Patches

0.35.2, 0.36.1, 0.37.1, 0.38.2
GitHub Security Advisory: GHSA-h4c3-5275-vrmg
Package: ckb (RUST)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.39.2
Patched in: 0.39.2

Summary: Nervos CKB Pool does not remove the conflicting transactions from the statistics 

Details:
### Impact

There's a bug in the pool statistics that when conflicting transactions are removed from the pool, they are not subtracted from the statics. Finally, the transaction pool keeps full and reject all transactions.

### Patches

0.39.2

### Workarounds

Restart the CKB node.
GitHub Security Advisory: GHSA-f56g-chqp-22m9
Package: libpulse-binding (RUST)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-416: Use After Free
Vulnerable versions: >= 1.0.5, < 2.5.0
Patched in: 2.5.0

Summary: Use after free in libpulse-binding

Details:
### Overview

Version 2.5.0 of the `libpulse-binding` Rust crate, released on the 22nd of December 2018, fixed a potential use-after-free issue with property list iteration due to a lack of a lifetime constraint tying the lifetime of a `proplist::Iterator` to the `Proplist` object for which it was created. This made it possible for users, without experiencing a compiler error/warning, to destroy the `Proplist` object before the iterator, thus destroying the underlying C object the iterator works upon, before the iterator may be finished with it.

This advisory is being written retrospectively, having previously only been noted in the changelog. No CVE assignment was sought.

This impacts all versions of the crate before 2.5.0 back to 1.0.5. Before version 1.0.5 the function that produces the iterator was broken to the point of being useless.

### Patches

Users are required to update to version 2.5.0 or newer.

Versions older than 2.5.0 have been yanked from crates.io as of the 22nd of October 2020.
GitHub Security Advisory: GHSA-q73f-w3h7-7wcc
Package: ckb (RUST)
Severity: CRITICAL (CVSS 0.0)
Vulnerable versions: <= 0.34.1
Patched in: 0.34.2

Summary: Nervos CKB Transaction which calls syscall load_cell_data_hash has nondeterministic result

Details:
### Impact
Tx-pool verify transaction which inputs' script contains `load_cell_data_hash` is nondeterministic


### Workarounds
Enforce tx-pool ResolvedTrascation inputs' load data is none.
GitHub Security Advisory: GHSA-3gjh-29fv-8hr6
Package: ckb (RUST)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: <= 0.34.1
Patched in: 0.34.2

Summary: Nervos CKB Snappy decompress length can be very large and causes out of memory error 

Details:
### Impact

Adversary can create message which compressed size is less than the package limit but the decompressed length is very large such as 1G. It will cost the node many memories to process the network messages, and on the system with less than 1G memory, the process is killed directly because of out of memory error.

### Patches

The node must check the decompress length before allocating the memory for the message.

### References

* https://github.com/nervosnetwork/ckb/blob/687d797f1888dd05d1f38ce6d1bef3e5b9b6e38b/network/src/compress.rs#L68
* https://github.com/BurntSushi/rust-snappy/blob/master/src/decompress.rs#L106
* https://github.com/BurntSushi/rust-snappy/blob/6cfb836463b9b3ac48ca7cd15d0a50d030e95769/src/decompress.rs#L30
GitHub Security Advisory: GHSA-wjxc-pjx9-4wvm
Package: ckb (RUST)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: <= 0.34.1
Patched in: 0.34.2

Summary: Nervos CKB Panic on malformed input

Details:
### Impact
CKB process will panic when received malformed p2p message because of snappy, which is used to compress network messages

### References
https://github.com/BurntSushi/rust-snappy/issues/29
GitHub Security Advisory: GHSA-hjqq-29pw-96wj
Package: ckb (RUST)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: >= 0.34.0, < 0.34.1
Patched in: 0.34.1

Summary: Nervos CKB node panics when processing a block which parent timestamp is too new

Details:
### Impact

Adversary can initiate DOS attack by broadcasting two consecutive blocks with timestamps in the future. 

### Patches

Please upgrade to v0.34.1
GitHub Security Advisory: GHSA-hjqq-29pw-96wj
Package: ckb (RUST)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: >= 0.33.0, < 0.33.2
Patched in: 0.33.2

Summary: Nervos CKB node panics when processing a block which parent timestamp is too new

Details:
### Impact

Adversary can initiate DOS attack by broadcasting two consecutive blocks with timestamps in the future. 

### Patches

Please upgrade to v0.34.1
GitHub Security Advisory: GHSA-r9rv-9mh8-pxf4
Package: ckb (RUST)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: <= 0.33.0
Patched in: 0.33.1

Summary: Nervos CKB BlockTimeTooNew should not be considered as invalid block

Details:
### Impact

Currently, when a node receives a block in future according to its local wall clock, it will mark the block as invalid and ban the peer. 

If the header's timestamp is more than 15 seconds ahead of our current time. In that case, the header may become valid in the future, and we don't want to disconnect a peer merely for serving us one too-far-ahead block header, to prevent an attacker from splitting the network by mining a block right at the  15 seconds boundary.

### Patches

Upgrade to v0.33.1 or above.

### Workarounds
Don't ban peer serving too-far-ahead block header.
GitHub Security Advisory: GHSA-pr39-8257-fxc2
Package: ckb (RUST)
Severity: LOW (CVSS 0.0)
Vulnerable versions: < 0.34.0
Patched in: 0.34.0

Summary: Nervos CKB DoS: Process exists when p2p discovery protocol receives unsupported peer IP

Details:
The p2p discovery protocol assumes that the peer IP must be valid IPv4 address.