deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-q89x-f52w-6hj2
Package: hyper (RUST)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
Vulnerable versions: < 0.9.18
Patched in: 0.9.18

Summary: Headers containing newline characters can split messages in hyper

Details:
Serializing of headers to the socket did not filter the values for newline bytes (\r or \n), which allowed for header values to split a request or response. People would not likely include newlines in the headers in their own applications, so the way for most people to exploit this is if an application constructs headers based on unsanitized user input.

This issue was fixed by replacing all newline characters with a space during serialization of a header value.
GitHub Security Advisory: GHSA-q89x-f52w-6hj2
Package: hyper (RUST)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
Vulnerable versions: >= 0.10.0, < 0.10.2
Patched in: 0.10.2

Summary: Headers containing newline characters can split messages in hyper

Details:
Serializing of headers to the socket did not filter the values for newline bytes (\r or \n), which allowed for header values to split a request or response. People would not likely include newlines in the headers in their own applications, so the way for most people to exploit this is if an application constructs headers based on unsanitized user input.

This issue was fixed by replacing all newline characters with a space during serialization of a header value.
GitHub Security Advisory: GHSA-pmcv-mgcf-rvxg
Package: crypto2 (RUST)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: <= 0.1.2
Patched in: unpatched

Summary: Non-aligned u32 read in Chacha20 encryption and decryption

Details:
The implementation does not enforce alignment requirements on input slices while incorrectly assuming 4-byte alignment through an unsafe call to `std::slice::from_raw_parts_mut`, which breaks the contract and introduces undefined behavior.

This affects Chacha20 encryption and decryption in crypto2.
GitHub Security Advisory: GHSA-r67p-m7g9-gxw6
Package: csv-sniffer (RUST)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: < 0.2.0
Patched in: 0.2.0

Summary: `Read` on uninitialized memory may cause UB (fn preamble_skipcount())

Details:
Affected versions of this crate passes an uninitialized buffer to a user-provided `Read` implementation (within `fn preamble_skipcount()`).

Arbitrary `Read` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer.
Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.
GitHub Security Advisory: GHSA-mpg5-fvwp-42m2
Package: dashmap (RUST)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: = 5.0.0
Patched in: 5.1.0

Summary: Unsoundness in `dashmap` references

Details:
Reference returned by some methods of `Ref` (and similar types) may outlive the `Ref` and escape the lock.
This causes undefined behavior and may result in a segfault.

More information in [`dashmap#167`](https://github.com/xacrimon/dashmap/issues/167) issue.
GitHub Security Advisory: GHSA-9rg7-3j4f-cf4x
Package: derive-com-impl (RUST)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.1.2
Patched in: 0.1.2

Summary: QueryInterface should call AddRef before returning pointer

Details:
Affected version of this crate, which is a required dependency in com-impl, 
provides a faulty implementation of the `IUnknown::QueryInterface` method.

`QueryInterface` implementation must call `IUnknown::AddRef` before returning the pointer,
as describe in this documentation:
<https://docs.microsoft.com/en-us/windows/win32/api/unknwn/nf-unknwn-iunknown-queryinterface(refiid_void)>

As it is not incrementing the refcount as expected, the following calls to `IUnknown::Release` method 
will cause WMI to drop reference to the interface, and can lead to invalid reference.

This is documented in <https://docs.microsoft.com/en-us/windows/win32/learnwin32/managing-the-lifetime-of-an-object#reference-counting>

There is no simple workaround, as you can't know how many time QueryInterface will be called.
The only way to quick fix this is to use the macro expanded version of the code and modify 
the QueryInterface method to add the AddRef call yourself.

The issue was corrected in commit `9803f31fbd1717d482d848f041044d061fca6da7`.
GitHub Security Advisory: GHSA-h352-g5vw-3926
Package: fruity (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 0.1.0, < 0.3.0
Patched in: 0.3.0

Summary: Improper Input Validation in fruity

Details:
Methods of NSString for conversion to a string may return a partial result. Since they call CStr::from_ptr on a pointer to the string buffer, the string is terminated at the first null byte, which might not be the end of the string.

In addition to the vulnerable functions listed for this issue, the implementations of Display, PartialEq, PartialOrd, and ToString for NSString are also affected, since they call those functions.

Since NSString is commonly used as the type for paths by the Foundation framework, null byte truncation might allow for easily bypassing file extension checks. For example, if a file name is provided by a user and validated to have one of a specific set of extensions, with validation taking place before truncation, an attacker can add an accepted extension after a null byte (e.g., file.exe\0.txt). After truncation, the file name used by the application would be file.exe.

It would be better to generate unique names for files, instead of using user-provided names, but not all applications take this approach.
GitHub Security Advisory: GHSA-r93v-9p5q-vhpf
Package: futures-task (RUST)
Severity: HIGH (CVSS 7.8)
CWE: CWE-416: Use After Free
Vulnerable versions: >= 0.2.1, < 0.3.6
Patched in: 0.3.6

Summary: futures_task::waker may cause a use-after-free if used on a type that isn't 'static

Details:
Affected versions of the crate did not properly implement a 'static lifetime bound on the waker function. This resulted in a use-after-free if Waker::wake() is called after original data had been dropped.

The flaw was corrected by adding 'static lifetime bound to the data waker takes.
GitHub Security Advisory: GHSA-p9m5-3hj7-cp5r
Package: futures-task (RUST)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-476: NULL Pointer Dereference
Vulnerable versions: < 0.3.5
Patched in: 0.3.5

Summary: futures_task::noop_waker_ref can segfault due to dereferencing a NULL pointer

Details:
Affected versions of the crate used a UnsafeCell in thread-local storage to return a noop waker reference, assuming that the reference would never be returned from another thread.

This resulted in a segmentation fault crash if Waker::wake_by_ref() was called on a waker returned from another thread due to it attempting to dereference a pointer that wasn't accessible from the main thread.
GitHub Security Advisory: GHSA-rh4w-94hh-9943
Package: futures-util (RUST)
Severity: MODERATE (CVSS 4.7)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vulnerable versions: >= 0.3.2, < 0.3.7
Patched in: 0.3.7

Summary: MutexGuard::map can cause a data race in safe code

Details:
Affected versions of the crate had a Send/Sync implementation for MappedMutexGuard that only considered variance on T, while MappedMutexGuard dereferenced to U.

This could of led to data races in safe Rust code when a closure used in MutexGuard::map() returns U that is unrelated to T.

The issue was fixed by fixing Send and Sync implementations, and by adding a PhantomData<&'a mut U> marker to the MappedMutexGuard type to tell the compiler that the guard is over U too.
GitHub Security Advisory: GHSA-9783-42pm-x5jq
Package: csv-sniffer (RUST)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-908: Use of Uninitialized Resource
Vulnerable versions: < 0.2.0
Patched in: 0.2.0

Summary: Use of Uninitialized Resource in csv-sniffer.

Details:
Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation (within fn preamble_skipcount()).

Arbitrary Read implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.
GitHub Security Advisory: GHSA-w4cc-pc2h-whcj
Package: derive-com-impl (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 0.1.2
Patched in: unpatched

Summary: Out-of-bounds Write in derive-com-impl

Details:
An issue was discovered in the derive-com-impl crate before 0.1.2 for Rust. An invalid reference (and memory corruption) can occur because AddRef might not be called before returning a pointer.
GitHub Security Advisory: GHSA-c9h5-hf8r-m97x
Package: flatbuffers (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-704: Incorrect Type Conversion or Cast
Vulnerable versions: >= 0.4.0, < 2.0.0
Patched in: 2.0.0

Summary: Dangling reference in flatbuffers

Details:
An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust. read_scalar (and read_scalar_at) can transmute values without unsafe blocks.
GitHub Security Advisory: GHSA-m8h8-v6jh-c762
Package: crossbeam-channel (RUST)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-131: Incorrect Calculation of Buffer Size
Vulnerable versions: >= 0.4.3, < 0.4.4
Patched in: 0.4.4

Summary: Incorrect buffer size in crossbeam-channel

Details:
The affected version of this crate's the bounded channel incorrectly assumes that Vec::from_iter has allocated capacity that same as the number of iterator elements. Vec::from_iter does not actually guarantee that and may allocate extra memory. The destructor of the bounded channel reconstructs Vec from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when Vec::from_iter has allocated different sizes with the number of iterator elements.
GitHub Security Advisory: GHSA-c3cw-c387-pj65
Package: crossbeam (RUST)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-415: Double Free
Vulnerable versions: >= 0.4.0, < 0.4.1
Patched in: 0.4.1

Summary: Double free in crossbeam

Details:
Even if an element is popped from a queue, crossbeam would run its destructor inside the epoch-based garbage collector. This is a source of double frees.

The flaw was corrected by wrapping elements inside queues in a ManuallyDrop.
GitHub Security Advisory: GHSA-c9rv-3jmq-527w
Package: branca (RUST)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 0.10.0
Patched in: 0.10.0

Summary: Unexpected panic when decoding tokens in branca

Details:
Prior to 0.10.0 it was possible to have both decoding functions panic unexpectedly, by supplying tokens with an incorrect base62 encoding.
The documentation stated that an error should have been reported instead.
GitHub Security Advisory: GHSA-v5m7-53cv-f3hx
Package: crossbeam-channel (RUST)
Severity: HIGH (CVSS 8.1)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer, CWE-401: Missing Release of Memory after Effective Lifetime
Vulnerable versions: = 0.4.3
Patched in: 0.4.4

Summary: crossbeam-channel Undefined Behavior before v0.4.4

Details:
### Impact

The affected version of this crate's the `bounded` channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not actually guarantee that and may allocate extra memory. The destructor of the `bounded` channel reconstructs `Vec` from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when `Vec::from_iter` has allocated different sizes with the number of iterator elements.

### Patches

This has been fixed in crossbeam-channel 0.4.4.

We recommend users to upgrade to 0.4.4.

### References

See https://github.com/crossbeam-rs/crossbeam/pull/533, https://github.com/crossbeam-rs/crossbeam/issues/539, and https://github.com/RustSec/advisory-db/pull/425 for more details.

### License

This advisory is in the public domain.
GitHub Security Advisory: GHSA-7j36-gc4r-9x3r
Package: compact_arena (RUST)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-125: Out-of-bounds Read, CWE-787: Out-of-bounds Write
Vulnerable versions: < 0.4.0
Patched in: 0.4.0

Summary: Out of bounds access in compact_arena

Details:
Affected versions of this crate did not properly implement the generativity, because the invariant lifetimes were not necessarily dropped.

This allows an attacker to mix up two arenas, using indices created from one arena with another one. This might lead to an out-of-bounds read or write access into the memory reserved for the arena.

The flaw was corrected by implementing generativity correctly in version 0.4.0.
GitHub Security Advisory: GHSA-8c6g-4xc5-w96c
Package: claxon (RUST)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-908: Use of Uninitialized Resource
Vulnerable versions: < 0.3.2
Patched in: 0.3.2

Summary: Uninitialized memory exposure in claxon

Details:
Affected versions of Claxon made an invalid assumption about the decode buffer size being a multiple of a value read from the bitstream. This could cause parts of the decode buffer to not be overwritten. If the decode buffer was newly allocated and uninitialized, this uninitialized memory could be exposed.

This allows an attacker to observe parts of the uninitialized memory in the decoded audio stream.

The flaw was corrected by checking that the value read from the bitstream divides the decode buffer size, and returning a format error if it does not. If an error is returned, the decode buffer is not exposed. Regression tests and an additional fuzzer have been added to prevent similar flaws in the future.
GitHub Security Advisory: GHSA-8c6g-4xc5-w96c
Package: claxon (RUST)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-908: Use of Uninitialized Resource
Vulnerable versions: >= 0.4.0, < 0.4.1
Patched in: 0.4.1

Summary: Uninitialized memory exposure in claxon

Details:
Affected versions of Claxon made an invalid assumption about the decode buffer size being a multiple of a value read from the bitstream. This could cause parts of the decode buffer to not be overwritten. If the decode buffer was newly allocated and uninitialized, this uninitialized memory could be exposed.

This allows an attacker to observe parts of the uninitialized memory in the decoded audio stream.

The flaw was corrected by checking that the value read from the bitstream divides the decode buffer size, and returning a format error if it does not. If an error is returned, the decode buffer is not exposed. Regression tests and an additional fuzzer have been added to prevent similar flaws in the future.
GitHub Security Advisory: GHSA-7cjc-hvxf-gqh7
Package: bitvec (RUST)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-415: Double Free, CWE-416: Use After Free
Vulnerable versions: >= 0.11.0, < 0.17.4
Patched in: 0.17.4

Summary: Use after free and double free in bitvec

Details:
An issue was discovered in the bitvec crate before 0.17.4 for Rust. BitVec to BitBox conversion leads to a use-after-free or double free.
GitHub Security Advisory: GHSA-qfh9-8p57-mjjj
Package: git-url-parse (RUST)
Severity: LOW (CVSS 0.0)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: <= 0.4.4
Patched in: unpatched

Summary: git-url-parse crate vulnerable to Regular Expression Denial of Service

Details:
The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to `normalize_url` in `lib.rs`, a similar issue to CVE-2023-32758 (Python).
GitHub Security Advisory: GHSA-5fm9-h728-fwpj
Package: trust-dns-server (RUST)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 0.23.0-alpha.2, < 0.23.0-alpha.3
Patched in: 0.23.0-alpha.3

Summary: trust-dns vulnerable to Remote Attackers causing Denial-of-Service (packet loops) with crafted DNS packets

Details:
trust-dns and trust-dns-server are vulnerable to remotely triggered denial-of-service attacks, consuming both network and CPU resources.
DNS messages with the QR=1 bit set are responded to with a `FormErr` response.
This allows creating a traffic loop, in which these `FormErr` responses are sent nonstop between vulnerable servers.

There are two scenarios how this can be exploited: 1) Create a loop between two instances of trust-dns, consuming network resources, or 2) consuming the CPU of a single instance.

With two instances *A* and *B* an attacker sends a DNS query with a spoofed source IP address to *A*.
*A* replies with a `FormErr` to *B*.
Now both servers with ping-pong the message back and forth until by chance the packet is dropped in the network.
Multiple spoofed packets can be sent by the attacker, increasing resource consumption.

A single server can get locked up replying to itself.
Same setup as above, but now *A* sends the reply to itself.
The packet is sent out as fast as the CPU and network stack manage.
This locks up a CPU core.
Multiple packets from the attacker consume multiple CPU cores.
GitHub Security Advisory: GHSA-5fm9-h728-fwpj
Package: trust-dns-server (RUST)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.22.1
Patched in: 0.22.1

Summary: trust-dns vulnerable to Remote Attackers causing Denial-of-Service (packet loops) with crafted DNS packets

Details:
trust-dns and trust-dns-server are vulnerable to remotely triggered denial-of-service attacks, consuming both network and CPU resources.
DNS messages with the QR=1 bit set are responded to with a `FormErr` response.
This allows creating a traffic loop, in which these `FormErr` responses are sent nonstop between vulnerable servers.

There are two scenarios how this can be exploited: 1) Create a loop between two instances of trust-dns, consuming network resources, or 2) consuming the CPU of a single instance.

With two instances *A* and *B* an attacker sends a DNS query with a spoofed source IP address to *A*.
*A* replies with a `FormErr` to *B*.
Now both servers with ping-pong the message back and forth until by chance the packet is dropped in the network.
Multiple spoofed packets can be sent by the attacker, increasing resource consumption.

A single server can get locked up replying to itself.
Same setup as above, but now *A* sends the reply to itself.
The packet is sent out as fast as the CPU and network stack manage.
This locks up a CPU core.
Multiple packets from the attacker consume multiple CPU cores.
GitHub Security Advisory: GHSA-29mf-62xx-28jq
Package: buffered-reader (RUST)
Severity: LOW (CVSS 2.9)
Vulnerable versions: >= 1.1.0, < 1.1.5
Patched in: 1.1.5

Summary: buffered-reader vulnerable to out-of-bounds array access leading to panic

Details:
Affected versions of the crate have a bug where attacker-controlled input can result in the use of an out-of-bound array index. Rust
detects the use of the out-of-bound index and causes the application to panic.  An attacker may be able to use this to cause a denial-of-service.  However, it is not possible for an attacker to read from or write to the application's address space.
GitHub Security Advisory: GHSA-29mf-62xx-28jq
Package: buffered-reader (RUST)
Severity: LOW (CVSS 2.9)
Vulnerable versions: < 1.0.2
Patched in: 1.0.2

Summary: buffered-reader vulnerable to out-of-bounds array access leading to panic

Details:
Affected versions of the crate have a bug where attacker-controlled input can result in the use of an out-of-bound array index. Rust
detects the use of the out-of-bound index and causes the application to panic.  An attacker may be able to use this to cause a denial-of-service.  However, it is not possible for an attacker to read from or write to the application's address space.
GitHub Security Advisory: GHSA-25mx-8f3v-8wh7
Package: sequoia-openpgp (RUST)
Severity: LOW (CVSS 2.9)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: >= 1.9.0, < 1.16.0
Patched in: 1.16.0

Summary: sequoia-openpgp vulnerable to out-of-bounds array access leading to panic

Details:
Affected versions of the crate have several bugs where attacker-controlled input can result in the use of an out-of-bound array index.  Rust detects the use of the out-of-bound index and causes the application to panic.  An attacker may be able to use this to cause a denial-of-service.  However, it is not possible for an attacker to read from or write to the application's address space.
GitHub Security Advisory: GHSA-25mx-8f3v-8wh7
Package: sequoia-openpgp (RUST)
Severity: LOW (CVSS 2.9)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: >= 1.2.0, < 1.8.1
Patched in: 1.8.1

Summary: sequoia-openpgp vulnerable to out-of-bounds array access leading to panic

Details:
Affected versions of the crate have several bugs where attacker-controlled input can result in the use of an out-of-bound array index.  Rust detects the use of the out-of-bound index and causes the application to panic.  An attacker may be able to use this to cause a denial-of-service.  However, it is not possible for an attacker to read from or write to the application's address space.
GitHub Security Advisory: GHSA-25mx-8f3v-8wh7
Package: sequoia-openpgp (RUST)
Severity: LOW (CVSS 2.9)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 1.1.1
Patched in: 1.1.1

Summary: sequoia-openpgp vulnerable to out-of-bounds array access leading to panic

Details:
Affected versions of the crate have several bugs where attacker-controlled input can result in the use of an out-of-bound array index.  Rust detects the use of the out-of-bound index and causes the application to panic.  An attacker may be able to use this to cause a denial-of-service.  However, it is not possible for an attacker to read from or write to the application's address space.
GitHub Security Advisory: GHSA-vc52-gwm3-8v2f
Package: deno_runtime (RUST)
Severity: HIGH (CVSS 8.6)
CWE: CWE-269: Improper Privilege Management, CWE-276: Incorrect Default Permissions
Vulnerable versions: = 0.114.0
Patched in: 0.115.0

Summary: Missing "--allow-net" permission check for built-in Node modules

Details:
### Impact

Outbound HTTP requests made using the built-in "node:http" or "node:https" modules are incorrectly not checked against the network permission allow list (`--allow-net`). Dependencies relying on these built-in modules are subject to the vulnerability too.

Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected.

### Patches

This problem has been patched in Deno v1.34.1 and all users are recommended to update to this version.

### Workarounds

No workaround is available for this issue.
GitHub Security Advisory: GHSA-vc52-gwm3-8v2f
Package: deno (RUST)
Severity: HIGH (CVSS 8.6)
CWE: CWE-269: Improper Privilege Management, CWE-276: Incorrect Default Permissions
Vulnerable versions: = 1.34.0
Patched in: 1.34.1

Summary: Missing "--allow-net" permission check for built-in Node modules

Details:
### Impact

Outbound HTTP requests made using the built-in "node:http" or "node:https" modules are incorrectly not checked against the network permission allow list (`--allow-net`). Dependencies relying on these built-in modules are subject to the vulnerability too.

Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected.

### Patches

This problem has been patched in Deno v1.34.1 and all users are recommended to update to this version.

### Workarounds

No workaround is available for this issue.