deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-h5rc-j5f5-3gcm
Package: russh (RUST)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: < 0.54.1
Patched in: 0.54.1

Summary: russh is missing overflow checks during channel windows adjust

Details:
### Summary
The channel window adjust message of the SSH protocol is used to track the free space in the receive buffer of the other side of a channel. The current implementation takes the value from the message and adds it to an internal state value. This can result in a integer overflow. If the Rust code is compiled with overflow checks, it will panic.  A malicious  client can crash a server. 

### Details
According https://datatracker.ietf.org/doc/html/rfc4254#section-5.2, The value must not overflow. 
The incorrect handling is done in server/encrypted.rs and client/encrypted.rs in the handling of CHANNEL_WINDOW_ADJUST. 

```
let amount = map_err!(u32::decode(&mut r))?;
...
channel.recipient_window_size += amount;
```

It could be replaced with something like 

```
  if let Some(ref mut channel) = enc.channels.get_mut(&channel_num) {
                        // rfc 4254: The window MUST NOT be increased above 2^32 - 1 bytes.
                        new_size = channel.recipient_window_size.saturating_add(amount);
                        channel.recipient_window_size = new_size;
                    }
...
```

### PoC
A customized client code would be required to send a message with a big value like u32_max. Not done yet.

### Impact
This problem seems only critical to a server. One user can crash the server, which might take down the service. A malicious server could also crash a single client, but this seems not very critical.
GitHub Security Advisory: GHSA-7h24-c332-p48c
Package: vproxy (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-369: Divide By Zero
Vulnerable versions: <= 2.3.3
Patched in: 2.4.0

Summary: vproxy Divide by Zero DoS Vulnerability

Details:
### Summary
Untrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state.

### Details
Untrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service.

The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183

### PoC
1. Download and run the latest version of vproxy
2. Send a cUrl request like the following, adjusting address and port as necessary: ```curl -x "http://test-ttl-0:test@127.0.0.1:8101" https://google.com```
3. Wait for a cUrl error indicating "Proxy CONNECT aborted"
4. View logs from the vproxy server
5. Observe that the vproxy server crashed due to a divide-by-zero panic

### Impact
The resulting crash renders the proxy server unusable until it is reset.

Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon ([dbohannon](https://github.com/dbohannon))
GitHub Security Advisory: GHSA-rpcf-rmh6-42xr
Package: netavark (RUST)
Severity: LOW (CVSS 3.7)
CWE: CWE-15: External Control of System or Configuration Setting
Vulnerable versions: < 1.15.1
Patched in: 1.15.1

Summary: Netavark Has Possible DNS Resolve Confusion 

Details:
A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the container is using the host's resolv.conf, and the DNS resolver will try to look into the search domains contained on it. If one of the domains contain a name with the same hostname as the running container, the connection will forward to unexpected external servers.
GitHub Security Advisory: GHSA-q5h2-xq96-6gmc
Package: buffered-reader (RUST)
Severity: LOW (CVSS 2.9)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: >= 1.1.0, < 1.1.5
Patched in: 1.1.5

Summary: Duplicate Advisory: buffered-reader vulnerable to out-of-bounds array access leading to panic

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-29mf-62xx-28jq. This link is maintained to preserve external references.

### Original Description
The buffered-reader crate before 1.2.0 for Rust allows out-of-bounds array access and a panic.
GitHub Security Advisory: GHSA-q5h2-xq96-6gmc
Package: buffered-reader (RUST)
Severity: LOW (CVSS 2.9)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 1.0.2
Patched in: 1.0.2

Summary: Duplicate Advisory: buffered-reader vulnerable to out-of-bounds array access leading to panic

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-29mf-62xx-28jq. This link is maintained to preserve external references.

### Original Description
The buffered-reader crate before 1.2.0 for Rust allows out-of-bounds array access and a panic.
GitHub Security Advisory: GHSA-286m-6pg9-v42v
Package: shlex (RUST)
Severity: LOW (CVSS 3.2)
CWE: CWE-116: Improper Encoding or Escaping of Output
Vulnerable versions: < 1.3.0
Patched in: 1.3.0

Summary: Duplicate Advisory: Multiple issues involving quote API in shlex

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-r7qv-8r2h-pg27. This link is maintained to preserve external references.

### Original Description
The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.
GitHub Security Advisory: GHSA-97f8-h76h-f297
Package: snow (RUST)
Severity: LOW (CVSS 3.1)
CWE: CWE-642: External Control of Critical State Data
Vulnerable versions: < 0.9.5
Patched in: 0.9.5

Summary: Duplicate Advisory: Unauthenticated Nonce Increment in snow

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-7g9j-g5jg-3vv3. This link is maintained to preserve external references.

### Original Description
The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery.
GitHub Security Advisory: GHSA-rfx3-ffrp-6875
Package: sequoia-openpgp (RUST)
Severity: LOW (CVSS 2.9)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: >= 1.9.0, < 1.16.0
Patched in: 1.16.0

Summary: Duplicate Advisory: sequoia-openpgp vulnerable to out-of-bounds array access leading to panic

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-25mx-8f3v-8wh7. This link is maintained to preserve external references.

### Original Description
The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic.
GitHub Security Advisory: GHSA-rfx3-ffrp-6875
Package: sequoia-openpgp (RUST)
Severity: LOW (CVSS 2.9)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: >= 1.2.0, < 1.8.1
Patched in: 1.8.1

Summary: Duplicate Advisory: sequoia-openpgp vulnerable to out-of-bounds array access leading to panic

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-25mx-8f3v-8wh7. This link is maintained to preserve external references.

### Original Description
The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic.
GitHub Security Advisory: GHSA-rfx3-ffrp-6875
Package: sequoia-openpgp (RUST)
Severity: LOW (CVSS 2.9)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 1.1.1
Patched in: 1.1.1

Summary: Duplicate Advisory: sequoia-openpgp vulnerable to out-of-bounds array access leading to panic

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-25mx-8f3v-8wh7. This link is maintained to preserve external references.

### Original Description
The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic.
GitHub Security Advisory: GHSA-j87p-gjr6-m4pv
Package: serde-json-wasm (RUST)
Severity: LOW (CVSS 3.2)
CWE: CWE-674: Uncontrolled Recursion
Vulnerable versions: < 0.5.2
Patched in: 0.5.2

Summary: Duplicate Advisory: serde-json-wasm stack overflow during recursive JSON parsing

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-rr69-rxr6-8qwf. This link is maintained to preserve external references.

### Original Description
The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.
GitHub Security Advisory: GHSA-j87p-gjr6-m4pv
Package: serde-json-wasm (RUST)
Severity: LOW (CVSS 3.2)
CWE: CWE-674: Uncontrolled Recursion
Vulnerable versions: = 1.0.0
Patched in: 1.0.1

Summary: Duplicate Advisory: serde-json-wasm stack overflow during recursive JSON parsing

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-rr69-rxr6-8qwf. This link is maintained to preserve external references.

### Original Description
The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.
GitHub Security Advisory: GHSA-gw89-822v-8v8g
Package: openssl (RUST)
Severity: MODERATE (CVSS 4.5)
CWE: CWE-126: Buffer Over-read
Vulnerable versions: >= 0.10.0, < 0.10.55
Patched in: 0.10.55

Summary: Duplicate Advisory: `openssl` `X509VerifyParamRef::set_host` buffer over-read

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-xcf7-rvmh-g6q4. This link is maintained to preserve external references.

### Original Description
The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.
GitHub Security Advisory: GHSA-p444-p2rm-hvrw
Package: transpose (RUST)
Severity: MODERATE (CVSS 4.5)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: >= 0.1.0, < 0.2.3
Patched in: 0.2.3

Summary: Duplicate Advisory: transpose: Buffer overflow due to integer overflow

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-5gmm-6m36-r7jh. This link is maintained to preserve external references.

### Original Description
The transpose crate before 0.2.3 for Rust allows an integer overflow via input_width and input_height arguments.
GitHub Security Advisory: GHSA-g693-v3jr-8hcr
Package: ed25519-dalek (RUST)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Vulnerable versions: < 2.0.0
Patched in: 2.0.0

Summary: Duplicate Advisory: `ed25519-dalek` Double Public Key Signing Function Oracle Attack

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-w5vr-6qhr-36cc. This link is maintained to preserve external references.

### Original Description
The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack. The Keypair implementation leads to a simple computation for extracting a private key.
GitHub Security Advisory: GHSA-rm83-pxjx-pr5j
Package: cosmwasm-std (RUST)
Severity: LOW (CVSS 3.7)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: >= 1.5.0, < 1.5.4
Patched in: 1.5.4

Summary: Duplicate Advisory: CosmWasm affected by arithmetic overflows

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-8724-5xmm-w5xq. This link is maintained to preserve external references.

### Original Description
The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations.
GitHub Security Advisory: GHSA-rm83-pxjx-pr5j
Package: cosmwasm-std (RUST)
Severity: LOW (CVSS 3.7)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: >= 1.3.0, < 1.4.4
Patched in: 1.4.4

Summary: Duplicate Advisory: CosmWasm affected by arithmetic overflows

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-8724-5xmm-w5xq. This link is maintained to preserve external references.

### Original Description
The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations.
GitHub Security Advisory: GHSA-4hff-hh47-7788
Package: curve25519-dalek (RUST)
Severity: LOW (CVSS 2.9)
CWE: CWE-733: Compiler Optimization Removal or Modification of Security-critical Code
Vulnerable versions: < 4.1.3
Patched in: 4.1.3

Summary: Duplicate Advisory: curve25519-dalek has timing variability in `curve25519-dalek`'s `Scalar29::sub`/`Scalar52::sub`

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-x4gp-pqpj-f43q. This link is maintained to preserve external references.

### Original Description
The curve25519-dalek crate before 4.1.3 for Rust has a constant-time operation on elliptic curve scalars that is removed by LLVM.
GitHub Security Advisory: GHSA-5c5j-jmhx-q2gr
Package: gix-transport (RUST)
Severity: MODERATE (CVSS 4.1)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 0.36.1
Patched in: 0.36.1

Summary: Duplicate Advisory: gix-transport code execution vulnerability

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-rrjw-j4m2-mf34. This link is maintained to preserve external references.

### Original Description
The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult to exploit.
GitHub Security Advisory: GHSA-g97w-mw7g-v3jv
Package: sequoia-openpgp (RUST)
Severity: LOW (CVSS 2.9)
CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Vulnerable versions: >= 1.13.0, < 1.21.0
Patched in: 1.21.0

Summary: Duplicate Advisory: Low severity (DoS) vulnerability in sequoia-openpgp

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-9344-p847-qm5c. This link is maintained to preserve external references.

### Original Description
The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertParser operations that encounter an unsupported primary key type.
GitHub Security Advisory: GHSA-624c-2h52-gf7f
Package: rosenpass (RUST)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-130: Improper Handling of Length Parameter Inconsistency
Vulnerable versions: < 0.2.1
Patched in: 0.2.1

Summary: Duplicate Advisory: Remotely exploitable denial of service in Rosenpass

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-6ggr-cwv4-g7qg. This link is maintained to preserve external references.

### Original Description
The rosenpass crate before 0.2.1 for Rust allows remote attackers to cause a denial of service (panic) via a one-byte UDP packet.
GitHub Security Advisory: GHSA-fm79-3f68-h2fc
Package: wasmtime (RUST)
Severity: LOW (CVSS 3.5)
CWE: CWE-672: Operation on a Resource after Expiration or Release
Vulnerable versions: >= 34.0.0, < 34.0.2
Patched in: 34.0.2

Summary: Wasmtime CLI  is vulnerable to host panic through its fd_renumber function

Details:
### Summary

A bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host (embedder).
The specific bug is triggered by calling `path_open` after calling `fd_renumber` with either:
- two equal argument values
- second argument being equal to a previously-closed file descriptor number value

The corrupt state introduced in `fd_renumber` will lead to the subsequent opening of a file descriptor to panic. This panic cannot introduce memory unsafety or allow WebAssembly to break outside of its sandbox, however. There is no possible heap corruption or memory unsafety from this panic.

This bug is in the implementation of Wasmtime's `wasmtime-wasi` crate which provides an implementation of WASIp1. The bug requires a specially crafted call to `fd_renumber` in addition to the ability to open a subsequent file descriptor. Opening a second file descriptor is only possible when a preopened directory was provided to the guest, and this is common amongst embeddings. A panic in the host is considered a denial-of-service vector for WebAssembly embedders and is thus a security issue in Wasmtime.

This bug does not affect WASIp2 and embedders using components.

### Patches

In accordance with Wasmtime's [release process](https://docs.wasmtime.dev/stability-release.html) patch releases are available as 24.0.4, 33.0.2, and 34.0.2. Users of other release of Wasmtime are recommended to move to a supported release of Wasmtime.

### Workarounds

Embedders who are using components or are not providing guest access to create more file descriptors (e.g. via a preopened filesystem directory) are not affected by this issue. Otherwise there is no workaround at this time and affected embeddings are recommended to update to a patched version which will not cause a panic in the host.
GitHub Security Advisory: GHSA-fm79-3f68-h2fc
Package: wasmtime (RUST)
Severity: LOW (CVSS 3.5)
CWE: CWE-672: Operation on a Resource after Expiration or Release
Vulnerable versions: >= 33.0.0, < 33.0.2
Patched in: 33.0.2

Summary: Wasmtime CLI  is vulnerable to host panic through its fd_renumber function

Details:
### Summary

A bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host (embedder).
The specific bug is triggered by calling `path_open` after calling `fd_renumber` with either:
- two equal argument values
- second argument being equal to a previously-closed file descriptor number value

The corrupt state introduced in `fd_renumber` will lead to the subsequent opening of a file descriptor to panic. This panic cannot introduce memory unsafety or allow WebAssembly to break outside of its sandbox, however. There is no possible heap corruption or memory unsafety from this panic.

This bug is in the implementation of Wasmtime's `wasmtime-wasi` crate which provides an implementation of WASIp1. The bug requires a specially crafted call to `fd_renumber` in addition to the ability to open a subsequent file descriptor. Opening a second file descriptor is only possible when a preopened directory was provided to the guest, and this is common amongst embeddings. A panic in the host is considered a denial-of-service vector for WebAssembly embedders and is thus a security issue in Wasmtime.

This bug does not affect WASIp2 and embedders using components.

### Patches

In accordance with Wasmtime's [release process](https://docs.wasmtime.dev/stability-release.html) patch releases are available as 24.0.4, 33.0.2, and 34.0.2. Users of other release of Wasmtime are recommended to move to a supported release of Wasmtime.

### Workarounds

Embedders who are using components or are not providing guest access to create more file descriptors (e.g. via a preopened filesystem directory) are not affected by this issue. Otherwise there is no workaround at this time and affected embeddings are recommended to update to a patched version which will not cause a panic in the host.
GitHub Security Advisory: GHSA-fm79-3f68-h2fc
Package: wasmtime (RUST)
Severity: LOW (CVSS 3.5)
CWE: CWE-672: Operation on a Resource after Expiration or Release
Vulnerable versions: >= 10.0.0, < 24.0.4
Patched in: 24.0.4

Summary: Wasmtime CLI  is vulnerable to host panic through its fd_renumber function

Details:
### Summary

A bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host (embedder).
The specific bug is triggered by calling `path_open` after calling `fd_renumber` with either:
- two equal argument values
- second argument being equal to a previously-closed file descriptor number value

The corrupt state introduced in `fd_renumber` will lead to the subsequent opening of a file descriptor to panic. This panic cannot introduce memory unsafety or allow WebAssembly to break outside of its sandbox, however. There is no possible heap corruption or memory unsafety from this panic.

This bug is in the implementation of Wasmtime's `wasmtime-wasi` crate which provides an implementation of WASIp1. The bug requires a specially crafted call to `fd_renumber` in addition to the ability to open a subsequent file descriptor. Opening a second file descriptor is only possible when a preopened directory was provided to the guest, and this is common amongst embeddings. A panic in the host is considered a denial-of-service vector for WebAssembly embedders and is thus a security issue in Wasmtime.

This bug does not affect WASIp2 and embedders using components.

### Patches

In accordance with Wasmtime's [release process](https://docs.wasmtime.dev/stability-release.html) patch releases are available as 24.0.4, 33.0.2, and 34.0.2. Users of other release of Wasmtime are recommended to move to a supported release of Wasmtime.

### Workarounds

Embedders who are using components or are not providing guest access to create more file descriptors (e.g. via a preopened filesystem directory) are not affected by this issue. Otherwise there is no workaround at this time and affected embeddings are recommended to update to a patched version which will not cause a panic in the host.
GitHub Security Advisory: GHSA-fm79-3f68-h2fc
Package: wasmtime-wasi (RUST)
Severity: LOW (CVSS 3.5)
CWE: CWE-672: Operation on a Resource after Expiration or Release
Vulnerable versions: >= 34.0.0, < 34.0.2
Patched in: 34.0.2

Summary: Wasmtime CLI  is vulnerable to host panic through its fd_renumber function

Details:
### Summary

A bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host (embedder).
The specific bug is triggered by calling `path_open` after calling `fd_renumber` with either:
- two equal argument values
- second argument being equal to a previously-closed file descriptor number value

The corrupt state introduced in `fd_renumber` will lead to the subsequent opening of a file descriptor to panic. This panic cannot introduce memory unsafety or allow WebAssembly to break outside of its sandbox, however. There is no possible heap corruption or memory unsafety from this panic.

This bug is in the implementation of Wasmtime's `wasmtime-wasi` crate which provides an implementation of WASIp1. The bug requires a specially crafted call to `fd_renumber` in addition to the ability to open a subsequent file descriptor. Opening a second file descriptor is only possible when a preopened directory was provided to the guest, and this is common amongst embeddings. A panic in the host is considered a denial-of-service vector for WebAssembly embedders and is thus a security issue in Wasmtime.

This bug does not affect WASIp2 and embedders using components.

### Patches

In accordance with Wasmtime's [release process](https://docs.wasmtime.dev/stability-release.html) patch releases are available as 24.0.4, 33.0.2, and 34.0.2. Users of other release of Wasmtime are recommended to move to a supported release of Wasmtime.

### Workarounds

Embedders who are using components or are not providing guest access to create more file descriptors (e.g. via a preopened filesystem directory) are not affected by this issue. Otherwise there is no workaround at this time and affected embeddings are recommended to update to a patched version which will not cause a panic in the host.