deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-5v8v-66v8-mwm7
Package: compu-brotli-sys (RUST)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Vulnerable versions: < 1.0.9
Patched in: 1.0.9

Summary: Integer overflow in the bundled Brotli C library

Details:
A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.
GitHub Security Advisory: GHSA-69fv-gw6g-8ccg
Package: arrayfire (RUST)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: < 3.6.0
Patched in: 3.6.0

Summary: Potential memory corruption in arrayfire

Details:
The attribute repr() added to enums to be compatible with C-FFI caused memory corruption on MSVC toolchain.

arrayfire crates <= version 3.5.0 do not have this issue when used with Rust versions 1.27 or earlier. The issue only started to appear since Rust version 1.28.

The issue seems to be interlinked with which version of Rust is being used.

The issue was fixed in crate 3.6.0.
GitHub Security Advisory: GHSA-rv9v-r4vm-gj8x
Package: miniscript (RUST)
Severity: MODERATE (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion, CWE-770: Allocation of Resources Without Limits or Throttling, CWE-787: Out-of-bounds Write
Vulnerable versions: < 9.2.0
Patched in: 9.2.0

Summary: Miniscript allows stack consumption

Details:
The Miniscript (aka rust-miniscript) library for Rust allows stack consumption because it does not properly track tree depth.
GitHub Security Advisory: GHSA-rv9v-r4vm-gj8x
Package: miniscript (RUST)
Severity: MODERATE (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion, CWE-770: Allocation of Resources Without Limits or Throttling, CWE-787: Out-of-bounds Write
Vulnerable versions: >= 10.0.0, < 10.2.0
Patched in: 10.2.0

Summary: Miniscript allows stack consumption

Details:
The Miniscript (aka rust-miniscript) library for Rust allows stack consumption because it does not properly track tree depth.
GitHub Security Advisory: GHSA-rv9v-r4vm-gj8x
Package: miniscript (RUST)
Severity: MODERATE (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion, CWE-770: Allocation of Resources Without Limits or Throttling, CWE-787: Out-of-bounds Write
Vulnerable versions: >= 11.0.0, < 11.2.0
Patched in: 11.2.0

Summary: Miniscript allows stack consumption

Details:
The Miniscript (aka rust-miniscript) library for Rust allows stack consumption because it does not properly track tree depth.
GitHub Security Advisory: GHSA-rv9v-r4vm-gj8x
Package: miniscript (RUST)
Severity: MODERATE (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion, CWE-770: Allocation of Resources Without Limits or Throttling, CWE-787: Out-of-bounds Write
Vulnerable versions: >= 12.0.0, < 12.2.0
Patched in: 12.2.0

Summary: Miniscript allows stack consumption

Details:
The Miniscript (aka rust-miniscript) library for Rust allows stack consumption because it does not properly track tree depth.
GitHub Security Advisory: GHSA-rwq6-crjg-9cpw
Package: ic_cdk (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-401: Missing Release of Memory after Effective Lifetime
Vulnerable versions: >= 0.15.0, < 0.15.1
Patched in: 0.15.1

Summary: ic-cdk has a memory leak when calling a canister method via `ic_cdk::call`

Details:
When a canister method is called via `ic_cdk::call*`, a new Future `CallFuture` is created  and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called `CallFutureState`.  A bug in the polling implementation of the `CallFuture` allows multiple references to be held for this internal state and not all references were dropped before the `Future` is resolved. Since we have unaccounted references held, a copy of the internal state ended up being persisted in the canister's heap and thus causing a memory leak. 

### Impact
Canisters built in Rust with `ic_cdk` and `ic_cdk_timers` are affected. If these canisters call a canister method, use timers or heartbeat, they will likely leak a small amount of memory on every such operation. **In the worst case, this could lead to heap memory exhaustion triggered by an attacker.**

Motoko based canisters are not affected by the bug.

### Patches
The patch has been backported to all minor versions between `>= 0.8.0, <= 0.15.0`. The patched versions available are `0.8.2, 0.9.3, 0.10.1, 0.11.6, 0.12.2, 0.13.5, 0.14.1, 0.15.1` and their previous versions have been yanked. 

### Workarounds
There are no known workarounds at the moment. Developers are recommended to upgrade their canister as soon as possible to the latest available patched version of `ic_cdk` to avoid running out of Wasm heap memory. 

> [!NOTE]  
> Upgrading the canisters (without updating `ic_cdk`) also frees the leaked memory but it's only a temporary solution.

### References
- [dfinity/cdk-rs/pull/509](https://github.com/dfinity/cdk-rs/pull/509)
- [ic_cdk docs](https://docs.rs/ic-cdk/latest/ic_cdk/)
- [Internet Computer Specification](https://internetcomputer.org/docs/current/references/ic-interface-spec)
GitHub Security Advisory: GHSA-rwq6-crjg-9cpw
Package: ic_cdk (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-401: Missing Release of Memory after Effective Lifetime
Vulnerable versions: >= 0.14.0, < 0.14.1
Patched in: 0.14.1

Summary: ic-cdk has a memory leak when calling a canister method via `ic_cdk::call`

Details:
When a canister method is called via `ic_cdk::call*`, a new Future `CallFuture` is created  and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called `CallFutureState`.  A bug in the polling implementation of the `CallFuture` allows multiple references to be held for this internal state and not all references were dropped before the `Future` is resolved. Since we have unaccounted references held, a copy of the internal state ended up being persisted in the canister's heap and thus causing a memory leak. 

### Impact
Canisters built in Rust with `ic_cdk` and `ic_cdk_timers` are affected. If these canisters call a canister method, use timers or heartbeat, they will likely leak a small amount of memory on every such operation. **In the worst case, this could lead to heap memory exhaustion triggered by an attacker.**

Motoko based canisters are not affected by the bug.

### Patches
The patch has been backported to all minor versions between `>= 0.8.0, <= 0.15.0`. The patched versions available are `0.8.2, 0.9.3, 0.10.1, 0.11.6, 0.12.2, 0.13.5, 0.14.1, 0.15.1` and their previous versions have been yanked. 

### Workarounds
There are no known workarounds at the moment. Developers are recommended to upgrade their canister as soon as possible to the latest available patched version of `ic_cdk` to avoid running out of Wasm heap memory. 

> [!NOTE]  
> Upgrading the canisters (without updating `ic_cdk`) also frees the leaked memory but it's only a temporary solution.

### References
- [dfinity/cdk-rs/pull/509](https://github.com/dfinity/cdk-rs/pull/509)
- [ic_cdk docs](https://docs.rs/ic-cdk/latest/ic_cdk/)
- [Internet Computer Specification](https://internetcomputer.org/docs/current/references/ic-interface-spec)
GitHub Security Advisory: GHSA-rwq6-crjg-9cpw
Package: ic_cdk (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-401: Missing Release of Memory after Effective Lifetime
Vulnerable versions: >= 0.13.0, < 0.13.4
Patched in: 0.13.5

Summary: ic-cdk has a memory leak when calling a canister method via `ic_cdk::call`

Details:
When a canister method is called via `ic_cdk::call*`, a new Future `CallFuture` is created  and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called `CallFutureState`.  A bug in the polling implementation of the `CallFuture` allows multiple references to be held for this internal state and not all references were dropped before the `Future` is resolved. Since we have unaccounted references held, a copy of the internal state ended up being persisted in the canister's heap and thus causing a memory leak. 

### Impact
Canisters built in Rust with `ic_cdk` and `ic_cdk_timers` are affected. If these canisters call a canister method, use timers or heartbeat, they will likely leak a small amount of memory on every such operation. **In the worst case, this could lead to heap memory exhaustion triggered by an attacker.**

Motoko based canisters are not affected by the bug.

### Patches
The patch has been backported to all minor versions between `>= 0.8.0, <= 0.15.0`. The patched versions available are `0.8.2, 0.9.3, 0.10.1, 0.11.6, 0.12.2, 0.13.5, 0.14.1, 0.15.1` and their previous versions have been yanked. 

### Workarounds
There are no known workarounds at the moment. Developers are recommended to upgrade their canister as soon as possible to the latest available patched version of `ic_cdk` to avoid running out of Wasm heap memory. 

> [!NOTE]  
> Upgrading the canisters (without updating `ic_cdk`) also frees the leaked memory but it's only a temporary solution.

### References
- [dfinity/cdk-rs/pull/509](https://github.com/dfinity/cdk-rs/pull/509)
- [ic_cdk docs](https://docs.rs/ic-cdk/latest/ic_cdk/)
- [Internet Computer Specification](https://internetcomputer.org/docs/current/references/ic-interface-spec)
GitHub Security Advisory: GHSA-rwq6-crjg-9cpw
Package: ic_cdk (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-401: Missing Release of Memory after Effective Lifetime
Vulnerable versions: >= 0.12.0, < 0.12.2
Patched in: 0.12.2

Summary: ic-cdk has a memory leak when calling a canister method via `ic_cdk::call`

Details:
When a canister method is called via `ic_cdk::call*`, a new Future `CallFuture` is created  and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called `CallFutureState`.  A bug in the polling implementation of the `CallFuture` allows multiple references to be held for this internal state and not all references were dropped before the `Future` is resolved. Since we have unaccounted references held, a copy of the internal state ended up being persisted in the canister's heap and thus causing a memory leak. 

### Impact
Canisters built in Rust with `ic_cdk` and `ic_cdk_timers` are affected. If these canisters call a canister method, use timers or heartbeat, they will likely leak a small amount of memory on every such operation. **In the worst case, this could lead to heap memory exhaustion triggered by an attacker.**

Motoko based canisters are not affected by the bug.

### Patches
The patch has been backported to all minor versions between `>= 0.8.0, <= 0.15.0`. The patched versions available are `0.8.2, 0.9.3, 0.10.1, 0.11.6, 0.12.2, 0.13.5, 0.14.1, 0.15.1` and their previous versions have been yanked. 

### Workarounds
There are no known workarounds at the moment. Developers are recommended to upgrade their canister as soon as possible to the latest available patched version of `ic_cdk` to avoid running out of Wasm heap memory. 

> [!NOTE]  
> Upgrading the canisters (without updating `ic_cdk`) also frees the leaked memory but it's only a temporary solution.

### References
- [dfinity/cdk-rs/pull/509](https://github.com/dfinity/cdk-rs/pull/509)
- [ic_cdk docs](https://docs.rs/ic-cdk/latest/ic_cdk/)
- [Internet Computer Specification](https://internetcomputer.org/docs/current/references/ic-interface-spec)
GitHub Security Advisory: GHSA-rwq6-crjg-9cpw
Package: ic_cdk (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-401: Missing Release of Memory after Effective Lifetime
Vulnerable versions: >= 0.11.0, < 0.11.5
Patched in: 0.11.6

Summary: ic-cdk has a memory leak when calling a canister method via `ic_cdk::call`

Details:
When a canister method is called via `ic_cdk::call*`, a new Future `CallFuture` is created  and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called `CallFutureState`.  A bug in the polling implementation of the `CallFuture` allows multiple references to be held for this internal state and not all references were dropped before the `Future` is resolved. Since we have unaccounted references held, a copy of the internal state ended up being persisted in the canister's heap and thus causing a memory leak. 

### Impact
Canisters built in Rust with `ic_cdk` and `ic_cdk_timers` are affected. If these canisters call a canister method, use timers or heartbeat, they will likely leak a small amount of memory on every such operation. **In the worst case, this could lead to heap memory exhaustion triggered by an attacker.**

Motoko based canisters are not affected by the bug.

### Patches
The patch has been backported to all minor versions between `>= 0.8.0, <= 0.15.0`. The patched versions available are `0.8.2, 0.9.3, 0.10.1, 0.11.6, 0.12.2, 0.13.5, 0.14.1, 0.15.1` and their previous versions have been yanked. 

### Workarounds
There are no known workarounds at the moment. Developers are recommended to upgrade their canister as soon as possible to the latest available patched version of `ic_cdk` to avoid running out of Wasm heap memory. 

> [!NOTE]  
> Upgrading the canisters (without updating `ic_cdk`) also frees the leaked memory but it's only a temporary solution.

### References
- [dfinity/cdk-rs/pull/509](https://github.com/dfinity/cdk-rs/pull/509)
- [ic_cdk docs](https://docs.rs/ic-cdk/latest/ic_cdk/)
- [Internet Computer Specification](https://internetcomputer.org/docs/current/references/ic-interface-spec)
GitHub Security Advisory: GHSA-rwq6-crjg-9cpw
Package: ic_cdk (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-401: Missing Release of Memory after Effective Lifetime
Vulnerable versions: >= 0.10.0, < 0.10.1
Patched in: 0.10.1

Summary: ic-cdk has a memory leak when calling a canister method via `ic_cdk::call`

Details:
When a canister method is called via `ic_cdk::call*`, a new Future `CallFuture` is created  and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called `CallFutureState`.  A bug in the polling implementation of the `CallFuture` allows multiple references to be held for this internal state and not all references were dropped before the `Future` is resolved. Since we have unaccounted references held, a copy of the internal state ended up being persisted in the canister's heap and thus causing a memory leak. 

### Impact
Canisters built in Rust with `ic_cdk` and `ic_cdk_timers` are affected. If these canisters call a canister method, use timers or heartbeat, they will likely leak a small amount of memory on every such operation. **In the worst case, this could lead to heap memory exhaustion triggered by an attacker.**

Motoko based canisters are not affected by the bug.

### Patches
The patch has been backported to all minor versions between `>= 0.8.0, <= 0.15.0`. The patched versions available are `0.8.2, 0.9.3, 0.10.1, 0.11.6, 0.12.2, 0.13.5, 0.14.1, 0.15.1` and their previous versions have been yanked. 

### Workarounds
There are no known workarounds at the moment. Developers are recommended to upgrade their canister as soon as possible to the latest available patched version of `ic_cdk` to avoid running out of Wasm heap memory. 

> [!NOTE]  
> Upgrading the canisters (without updating `ic_cdk`) also frees the leaked memory but it's only a temporary solution.

### References
- [dfinity/cdk-rs/pull/509](https://github.com/dfinity/cdk-rs/pull/509)
- [ic_cdk docs](https://docs.rs/ic-cdk/latest/ic_cdk/)
- [Internet Computer Specification](https://internetcomputer.org/docs/current/references/ic-interface-spec)
GitHub Security Advisory: GHSA-rwq6-crjg-9cpw
Package: ic_cdk (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-401: Missing Release of Memory after Effective Lifetime
Vulnerable versions: >= 0.9.0, < 0.9.3
Patched in: 0.9.3

Summary: ic-cdk has a memory leak when calling a canister method via `ic_cdk::call`

Details:
When a canister method is called via `ic_cdk::call*`, a new Future `CallFuture` is created  and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called `CallFutureState`.  A bug in the polling implementation of the `CallFuture` allows multiple references to be held for this internal state and not all references were dropped before the `Future` is resolved. Since we have unaccounted references held, a copy of the internal state ended up being persisted in the canister's heap and thus causing a memory leak. 

### Impact
Canisters built in Rust with `ic_cdk` and `ic_cdk_timers` are affected. If these canisters call a canister method, use timers or heartbeat, they will likely leak a small amount of memory on every such operation. **In the worst case, this could lead to heap memory exhaustion triggered by an attacker.**

Motoko based canisters are not affected by the bug.

### Patches
The patch has been backported to all minor versions between `>= 0.8.0, <= 0.15.0`. The patched versions available are `0.8.2, 0.9.3, 0.10.1, 0.11.6, 0.12.2, 0.13.5, 0.14.1, 0.15.1` and their previous versions have been yanked. 

### Workarounds
There are no known workarounds at the moment. Developers are recommended to upgrade their canister as soon as possible to the latest available patched version of `ic_cdk` to avoid running out of Wasm heap memory. 

> [!NOTE]  
> Upgrading the canisters (without updating `ic_cdk`) also frees the leaked memory but it's only a temporary solution.

### References
- [dfinity/cdk-rs/pull/509](https://github.com/dfinity/cdk-rs/pull/509)
- [ic_cdk docs](https://docs.rs/ic-cdk/latest/ic_cdk/)
- [Internet Computer Specification](https://internetcomputer.org/docs/current/references/ic-interface-spec)
GitHub Security Advisory: GHSA-rwq6-crjg-9cpw
Package: ic_cdk (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-401: Missing Release of Memory after Effective Lifetime
Vulnerable versions: >= 0.8.0, < 0.8.2
Patched in: 0.8.2

Summary: ic-cdk has a memory leak when calling a canister method via `ic_cdk::call`

Details:
When a canister method is called via `ic_cdk::call*`, a new Future `CallFuture` is created  and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called `CallFutureState`.  A bug in the polling implementation of the `CallFuture` allows multiple references to be held for this internal state and not all references were dropped before the `Future` is resolved. Since we have unaccounted references held, a copy of the internal state ended up being persisted in the canister's heap and thus causing a memory leak. 

### Impact
Canisters built in Rust with `ic_cdk` and `ic_cdk_timers` are affected. If these canisters call a canister method, use timers or heartbeat, they will likely leak a small amount of memory on every such operation. **In the worst case, this could lead to heap memory exhaustion triggered by an attacker.**

Motoko based canisters are not affected by the bug.

### Patches
The patch has been backported to all minor versions between `>= 0.8.0, <= 0.15.0`. The patched versions available are `0.8.2, 0.9.3, 0.10.1, 0.11.6, 0.12.2, 0.13.5, 0.14.1, 0.15.1` and their previous versions have been yanked. 

### Workarounds
There are no known workarounds at the moment. Developers are recommended to upgrade their canister as soon as possible to the latest available patched version of `ic_cdk` to avoid running out of Wasm heap memory. 

> [!NOTE]  
> Upgrading the canisters (without updating `ic_cdk`) also frees the leaked memory but it's only a temporary solution.

### References
- [dfinity/cdk-rs/pull/509](https://github.com/dfinity/cdk-rs/pull/509)
- [ic_cdk docs](https://docs.rs/ic-cdk/latest/ic_cdk/)
- [Internet Computer Specification](https://internetcomputer.org/docs/current/references/ic-interface-spec)
GitHub Security Advisory: GHSA-g5jh-57wm-p79m
Package: aardvark-dns (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 1.12.0, < 1.12.2
Patched in: 1.12.2

Summary: Missing connection timeout in Aardvark-dns

Details:
A flaw was found in Aardvark-dns versions 1.12.0 and 1.12.1. They contain a denial of service vulnerability due to serial processing of TCP DNS queries. This flaw allows a malicious client to keep a TCP connection open indefinitely, causing other DNS queries to time out and resulting in a denial of service for all other containers using aardvark-dns.
GitHub Security Advisory: GHSA-p2q9-36vw-c468
Package: olm-sys (RUST)
Severity: HIGH (CVSS 0.0)
CWE: CWE-1395: Dependency on Vulnerable Third-Party Component
Vulnerable versions: <= 1.3.2
Patched in: unpatched

Summary: olm-sys: wrapped library unmaintained, potentially vulnerable

Details:
After several cryptographic vulnerabilities in `libolm` were disclosed publicly, the Matrix Foundation has [officially deprecated the library](https://matrix.org/blog/2024/08/libolm-deprecation/). `olm-sys` is a thin wrapper around `libolm` and is now deprecated and potentially vulnerable in kind.

Users of `olm-sys` and its higher-level abstraction, `olm-rs`, are highly encouraged to switch to [`vodozemac`](https://crates.io/crates/vodozemac) as soon as possible. It is the successor effort to `libolm` and is written in Rust.
GitHub Security Advisory: GHSA-vr26-jcq5-fjj8
Package: quinn-proto (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-670: Always-Incorrect Control Flow Implementation
Vulnerable versions: >= 0.11.0, < 0.11.7
Patched in: 0.11.7

Summary: Denial of service in quinn-proto when using `Endpoint::retry()`

Details:
### Summary

As of quinn-proto 0.11, it is possible for a server to `accept()`, `retry()`, `refuse()`, or `ignore()` an `Incoming` connection. However, calling `retry()` on an unvalidated connection exposes the server to a likely panic in the following situations:

- Calling `refuse` or `ignore` on the resulting validated connection, if a duplicate initial packet is received
  - This issue can go undetected until a server's `refuse()`/`ignore()` code path is exercised, such as to stop a denial of service attack.
- Accepting when the initial packet for the resulting validated connection fails to decrypt or exhausts connection IDs, if a similar initial packet that successfully decrypts and doesn't exhaust connection IDs is received.
  - This issue can go undetected if clients are well-behaved.

The former situation was observed in a real application, while the latter is only theoretical.

### Details

Location of panic: https://github.com/quinn-rs/quinn/blob/bb02a12a8435a7732a1d762783eeacbb7e50418e/quinn-proto/src/endpoint.rs#L213

### Impact
Denial of service for internet-facing server