deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-jrcf-4jp8-m28v
Package: miow (RUST)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-188: Reliance on Data/Memory Layout
Vulnerable versions: >= 0.3.0, < 0.3.6
Patched in: 0.3.6

Summary: miow invalidly assumes the memory layout of std::net::SocketAddr

Details:
The miow crate has assumed std::net::SocketAddrV4 and std::net::SocketAddrV6 have the same memory layout as the system C representation sockaddr. It has simply casted the pointers to convert the socket addresses to the system representation. The standard library does not say anything about the memory layout, and this will cause invalid memory access if the standard library changes the implementation. No warnings or errors will be emitted once the change happens.
GitHub Security Advisory: GHSA-q9h2-4xhf-23xx
Package: im (RUST)
Severity: MODERATE (CVSS 4.7)
CWE: CWE-662: Improper Synchronization
Vulnerable versions: >= 12.0.0, < 15.1.0
Patched in: 15.1.0

Summary: Data races in im

Details:
An issue was discovered in the im crate prior to 15.1.0 for Rust. Because TreeFocus does not have bounds on its Send trait or Sync trait, a data race can occur.
GitHub Security Advisory: GHSA-ffx3-8qvm-pq3j
Package: solana_rbpf (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: < 0.2.29
Patched in: 0.2.29

Summary: Integer overflow in solana_rbpf

Details:
Solana solana_rbpf before 0.2.29 has an addition integer overflow via invalid ELF program headers. elf.rs has a panic via a malformed eBPF program.
GitHub Security Advisory: GHSA-9qmm-4mfr-r3wj
Package: solana_rbpf (RUST)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-682: Incorrect Calculation
Vulnerable versions: >= 0.2.26, < 0.2.28
Patched in: 0.2.28

Summary: Incorrect Calculation in solana_rbpf

Details:
In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to transfer tokens or not. The vulnerability affects both integrity and may cause serious availability problems.
GitHub Security Advisory: GHSA-8m49-2xj8-67v9
Package: Simple-Wayland-HotKey-Daemon (RUST)
Severity: HIGH (CVSS 7.1)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: < 1.2.0
Patched in: 1.2.0

Summary: Data Loss/Denial of Service in SWHKD

Details:
SWHKD 1.1.5 unsafely uses the /tmp/swhks.pid pathname. There can be data loss or a denial of service. A patch is available on the `1.1.0` branch of the repository.
GitHub Security Advisory: GHSA-p4jg-pccf-h82c
Package: Simple-Wayland-HotKey-Daemon (RUST)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following'), CWE-377: Insecure Temporary File
Vulnerable versions: < 1.2.0
Patched in: 1.2.0

Summary: Insecure Temporary File in SWHKD

Details:
SWHKD is a display protocol-independent hotkey daemon made in Rust. In SWHKD versions 1.1.5 and prior, SWHKD uses the /tmp/swhkd.pid pathname. As /tmp is accessible to all users, there can be an information leak or denial of service. No known workarounds exist. A patch is available on the `1.1.0` branch of the repository.
GitHub Security Advisory: GHSA-x446-3xhq-5xfp
Package: Simple-Wayland-HotKey-Daemon (RUST)
Severity: LOW (CVSS 3.3)
CWE: CWE-668: Exposure of Resource to Wrong Sphere
Vulnerable versions: < 1.2.0
Patched in: 1.2.0

Summary: Exposure of Resource to Wrong Sphere in Simple-Wayland-HotKey-Daemon

Details:
SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option.
GitHub Security Advisory: GHSA-mmc9-pwm7-qj5w
Package: rand_core (RUST)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-704: Incorrect Type Conversion or Cast
Vulnerable versions: < 0.3.1
Patched in: 0.3.1

Summary: Unaligned memory access in rand_core

Details:
### Impact
Affected versions of this crate violated alignment when casting byte slices to integer slices, resulting in undefined behavior. `rand_core::BlockRng::next_u64` and `rand_core::BlockRng::fill_bytes` are affected.

### Patches
The flaw was corrected by Ralf Jung and Diggory Hardy for `rand_core >= 0.4.2`.

### Workarounds
None.

### References
See [Rand's changelog](https://github.com/rust-random/rand/blob/master/rand_core/CHANGELOG.md#050---2019-06-06).

### For more information
If you have any questions or comments about this advisory, [open an issue in the Rand repository](https://github.com/rust-random/rand/issues/new/choose).
GitHub Security Advisory: GHSA-h5wh-7h2j-h999
Package: Simple-Wayland-HotKey-Daemon (RUST)
Severity: MODERATE (CVSS 4.4)
CWE: CWE-668: Exposure of Resource to Wrong Sphere
Vulnerable versions: <= 1.1.5
Patched in: unpatched

Summary: Exposure of Resource to Wrong Sphere in Simple-Wayland-HotKey-Daemon

Details:
SWHKD 1.1.5 consumes the keyboard events of unintended users. This could potentially cause an information leak, but is usually a denial of functionality.
GitHub Security Advisory: GHSA-j35p-q24r-5367
Package: ckb (RUST)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: < 0.43.1
Patched in: 0.43.1

Summary: Dep Group Remote Memory Exhaustion (Denial of Service) in ckb

Details:
### Impact
A remote attacker could exploit this vulnerability to exhaust ckb process memory of an affected node.

### Patches
Upgrade to 0.43.1 or later.

### References
After resolving the outpoints of one dep group, we put the corresponding content into a vec ( https://github.com/nervosnetwork/ckb/blob/v0.42.0/util/types/src/core/cell.rs#L600-L617 ), there is a vulnerability to a memory dos attack because there is no determination of whether the outpoints is duplicated.

PoC:
```
before send dos tx rss:
105700

after rss:
2306932
```

DoS cost: 25.6 KB * 150 + dep_tx out_points capacity ( 36 * 150 * 100 = 540000 ) = 4380000 CKB
Send 50 dos_tx, memory exhausted: (25.6 KB * 150  * 100) * 50 = 19.2 GB
GitHub Security Advisory: GHSA-3227-r97m-8j95
Package: afire (RUST)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-34: Path Traversal: '....//'
Vulnerable versions: >= 0.2.1, < 1.1.0
Patched in: 1.1.0

Summary: Relative Path Traversal in afire serve_static

Details:
### Impact
This vulnerability effects the built-in afire serve_static extension allowing paths containing `//....` to bypass the previous path sanitation and request files in higher directories that should not be accessible.

### Patches
The issue has been fixed in [afire 1.1.0](https://crates.io/crates/afire/1.1.0).
If you can, just update to the newest version of afire.

### Workarounds
If you can't update afire you can simply disallow paths containing `/..` with the following middleware.
Make sure this is the last middleware added to the server so it runs first, stopping the bad requests.
```rust
use afire::prelude::*;

struct PathTraversalFix;

impl Middleware for PathTraversalFix {
    fn pre(&self, req: Request) -> MiddleRequest {
        if req.path.replace("\\", "/").contains("/..") {
            return MiddleRequest::Send(
                Response::new()
                    .status(400)
                    .text("Paths containing `..` are not allowed"),
            );
        }

        MiddleRequest::Continue
    }
}
```
```rust
let mut server = Server::new(host, port);
PathTraversalFix.attach(&mut server);
```

### References
You can read about the new changes to afire in 1.1.0 [here](https://connorcode.com/writing/afire/update-3)

### For more information
If you have any questions or comments about this advisory you can email me or message me on discord.
[[https://connorcode.com/contact](https://connorcode.com/contact)]
GitHub Security Advisory: GHSA-838h-jqp6-cf2f
Package: deno (RUST)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-269: Improper Privilege Management, CWE-863: Incorrect Authorization
Vulnerable versions: >= 1.18.0, < 1.20.3
Patched in: 1.20.3

Summary: Sandbox bypass leading to arbitrary code execution in Deno

Details:
### Impact

The versions of Deno between release 1.18.0 and 1.20.2 (inclusive) are vulnerable to an attack where a malicious actor controlling the code executed in a Deno runtime could bypass permission checks and execute arbitrary shell code.

There is **no** evidence that this vulnerability has been exploited in the wild.

This vulnerability does **not** affect users of Deno Deploy.

### Patches

The vulnerability has been patched in Deno 1.20.3.

### Workarounds

There is no workaround. All users are recommended to upgrade to 1.20.3 immediately

---

The cause of this error was that certain FFI operations did not correctly check for permissions. The issue was fixed in [this](https://github.com/denoland/deno/pull/14115) pull request.
GitHub Security Advisory: GHSA-m5pq-gvj9-9vr8
Package: regex (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: < 1.5.5
Patched in: 1.5.5

Summary: Rust's regex crate vulnerable to regular expression denial of service

Details:
> This is a cross-post of [the official security advisory][advisory]. The official advisory contains a signed version with our PGP key, as well.

[advisory]: https://groups.google.com/g/rustlang-security-announcements/c/NcNNL1Jq7Yw

The Rust Security Response WG was notified that the `regex` crate did not properly limit the complexity of the regular expressions (regex) it parses. An attacker could use this security issue to perform a denial of service, by sending a specially crafted regex to a service accepting untrusted regexes. No known vulnerability is present when parsing untrusted input with trusted regexes.

This issue has been assigned CVE-2022-24713. The severity of this vulnerability is "high" when the `regex` crate is used to parse untrusted regexes. Other uses of the `regex` crate are not affected by this vulnerability.

## Overview

The `regex` crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it's considered part of the crate's API.

Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing, and it's possible to craft regexes that bypass such mitigations. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted regexes.

## Affected versions

All versions of the `regex` crate before or equal to 1.5.4 are affected by this issue. The fix is include starting from  `regex` 1.5.5.

## Mitigations

We recommend everyone accepting user-controlled regexes to upgrade immediately to the latest version of the `regex` crate.

Unfortunately there is no fixed set of problematic regexes, as there are practically infinite regexes that could be crafted to exploit this vulnerability. Because of this, we do not recommend denying known problematic regexes.

## Acknowledgements

We want to thank Addison Crump for responsibly disclosing this to us according to the [Rust security policy](https://www.rust-lang.org/policies/security), and for helping review the fix.

We also want to thank Andrew Gallant for developing the fix, and Pietro Albini for coordinating the disclosure and writing this advisory.
GitHub Security Advisory: GHSA-qc84-gqf4-9926
Package: crossbeam-utils (RUST)
Severity: HIGH (CVSS 8.1)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vulnerable versions: < 0.8.7
Patched in: 0.8.7

Summary: crossbeam-utils Unsoundness of AtomicCell<{i,u}64> arithmetics on 32-bit targets that support Atomic{I,U}64

Details:
### Impact

The affected versions of this crate incorrectly assumed that the alignment of `{i,u}64` was always the same as `Atomic{I,U}64`. 

However, the alignment of `{i,u}64` on a 32-bit target can be smaller than `Atomic{I,U}64`.

This can cause the following problems:

- Unaligned memory accesses
- Data race

Crates using `fetch_*` methods with `AtomicCell<{i,u}64>` are affected by this issue.

32-bit targets without `Atomic{I,U}64` and 64-bit targets are not affected by this issue.
32-bit targets with `Atomic{I,U}64` and `{i,u}64` have the same alignment are also not affected by this issue.

The following is a complete list of the builtin targets that may be affected. (last update: nightly-2022-02-11)

- armv7-apple-ios (tier 3)
- armv7s-apple-ios (tier 3)
- i386-apple-ios (tier 3)
- i586-unknown-linux-gnu
- i586-unknown-linux-musl
- i686-apple-darwin (tier 3)
- i686-linux-android
- i686-unknown-freebsd
- i686-unknown-haiku (tier 3)
- i686-unknown-linux-gnu
- i686-unknown-linux-musl
- i686-unknown-netbsd (tier 3)
- i686-unknown-openbsd (tier 3)
- i686-wrs-vxworks (tier 3)

([script to get list](https://gist.github.com/taiki-e/3c7891e8c5f5e0cbcb44d7396aabfe10))

### Patches

This has been fixed in crossbeam-utils 0.8.7.

Affected 0.8.x releases have been yanked.

### References

https://github.com/crossbeam-rs/crossbeam/pull/781 

### License

This advisory is in the public domain.
GitHub Security Advisory: GHSA-gm68-g349-gxgg
Package: bingrep (RUST)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: = 0.8.5
Patched in: unpatched

Summary: Denial of service in bingrep

Details:
Bingrep v0.8.5 was discovered to contain a memory allocation failure which can cause a Denial of Service (DoS).
GitHub Security Advisory: GHSA-xwqr-xmgg-j69q
Package: solana_rbpf (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: >= 0.2.14, < 0.2.17
Patched in: 0.2.17

Summary: Integer overflow in solana_rbpf

Details:
From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs has an integer overflow bug because the sym.st_value is read directly from ELF file without checking. If the sym.st_value is rather large, an integer overflow is triggered while calculating the variable "addr" via `addr = (sym.st_value + refd_pa) as u64`
GitHub Security Advisory: GHSA-9qj6-4rfq-vm84
Package: actix-web (RUST)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 0.7.15
Patched in: 0.7.15

Summary: Out-of-bounds Write in actix-web

Details:
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly coerce an immutable reference into a mutable reference, leading to memory corruption.
GitHub Security Advisory: GHSA-fgfm-hqjw-3265
Package: actix-web (RUST)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 0.7.15
Patched in: 0.7.15

Summary: Out-of-bounds Write in actix-web

Details:
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string, leading to memory corruption.
GitHub Security Advisory: GHSA-7x36-h62w-vw65
Package: actix-web (RUST)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 0.7.15
Patched in: 0.7.15

Summary: Out-of-bounds Write in actix-web

Details:
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely, leading to memory corruption.
GitHub Security Advisory: GHSA-v938-qcc9-rwv8
Package: buffoon (RUST)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-908: Use of Uninitialized Resource
Vulnerable versions: <= 0.5.0
Patched in: unpatched

Summary: Use of Uninitialized Resource in buffoon.

Details:
Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation.
Arbitrary Read implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.
GitHub Security Advisory: GHSA-v2ch-fc8f-qm33
Package: bite (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-908: Use of Uninitialized Resource
Vulnerable versions: <= 0.0.5
Patched in: unpatched

Summary: Use of Uninitialized Resource in bite.

Details:
An issue was discovered in the bite crate through 2020-12-31 for Rust. read::BiteReadExpandedExt::read_framed_max may read from uninitialized memory locations.
GitHub Security Advisory: GHSA-xvcg-2q82-r87j
Package: libpulse-binding (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-248: Uncaught Exception
Vulnerable versions: < 2.6.0
Patched in: 2.6.0

Summary: Panic mishandled in libpulse-binding

Details:
An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface (FFI) boundary.
GitHub Security Advisory: GHSA-x76r-966h-5qv9
Package: vec-const (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 2.0.0
Patched in: 2.0.0

Summary: Out-of-bounds Write in vec-const

Details:
An issue was discovered in the vec-const crate before 2.0.0 for Rust. It tries to construct a Vec from a pointer to a const slice, leading to memory corruption.
GitHub Security Advisory: GHSA-p4cr-64x4-f92f
Package: acc_reader (RUST)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-908: Use of Uninitialized Resource
Vulnerable versions: <= 2.0.0
Patched in: unpatched

Summary: Use of Uninitialized Resource in acc_reader.

Details:
An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. fill_buf may read from uninitialized memory locations.
GitHub Security Advisory: GHSA-799f-r78p-gq9c
Package: acc_reader (RUST)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-908: Use of Uninitialized Resource
Vulnerable versions: <= 2.0.0
Patched in: unpatched

Summary: Use of Uninitialized Resource in acc_reader.

Details:
An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. read_up_to may read from uninitialized memory locations.
GitHub Security Advisory: GHSA-cw4j-cf6c-mmfv
Package: binjs_io (RUST)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-908: Use of Uninitialized Resource
Vulnerable versions: <= 0.2.1
Patched in: unpatched

Summary: Use of Uninitialized Resource in binjs_io.

Details:
An issue was discovered in the binjs_io crate through 2021-01-03 for Rust. The Read method may read from uninitialized memory locations.
GitHub Security Advisory: GHSA-jv2r-jx6q-89jg
Package: bronzedb-protocol (RUST)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-908: Use of Uninitialized Resource
Vulnerable versions: <= 0.1.0
Patched in: unpatched

Summary: Use of Uninitialized Resource in bronzedb-protocol.

Details:
An issue was discovered in the bronzedb-protocol crate through 2021-01-03 for Rust. ReadKVExt may read from uninitialized memory locations.
GitHub Security Advisory: GHSA-9mp7-45qh-r8j8
Package: columnar (RUST)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-908: Use of Uninitialized Resource
Vulnerable versions: <= 0.0.19
Patched in: unpatched

Summary: columnar: Read on uninitialized buffer may cause UB (ColumnarReadExt::read_typed_vec())

Details:
Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation (ColumnarReadExt::read_typed_vec()).

Arbitrary Read implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.
GitHub Security Advisory: GHSA-64wv-8vwp-xgw2
Package: ash (RUST)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-908: Use of Uninitialized Resource
Vulnerable versions: < 0.33.1
Patched in: 0.33.1

Summary: Use of Uninitialized Resource in ash.

Details:
An issue was discovered in the ash crate before 0.33.1 for Rust. util::read_spv may read from uninitialized memory locations.
GitHub Security Advisory: GHSA-vw5m-qw2r-m923
Package: messagepack-rs (RUST)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-908: Use of Uninitialized Resource
Vulnerable versions: <= 0.8.1
Patched in: unpatched

Summary: Use of Uninitialized Resource in messagepack-rs.

Details:
An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_binary may read from uninitialized memory locations.
GitHub Security Advisory: GHSA-ff2r-xpwq-6whj
Package: gfx-auxil (RUST)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-908: Use of Uninitialized Resource
Vulnerable versions: <= 0.10.0
Patched in: unpatched

Summary: Use of Uninitialized Resource in gfx-auxil

Details:
Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation.

Arbitrary Read implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.
GitHub Security Advisory: GHSA-2rxc-8f9w-fjq8
Package: rdiff (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-908: Use of Uninitialized Resource
Vulnerable versions: <= 0.1.2
Patched in: unpatched

Summary: Window may read from uninitialized memory locations in rdiff

Details:
An issue was discovered in the rdiff crate through version 0.1.2 for Rust. Window may read from uninitialized memory locations.
GitHub Security Advisory: GHSA-jqjj-r4qp-x2gh
Package: messagepack-rs (RUST)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-908: Use of Uninitialized Resource
Vulnerable versions: <= 0.8.1
Patched in: unpatched

Summary: Use of Uninitialized Resource in messagepack-rs.

Details:
An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_string_primitive may read from uninitialized memory locations.
GitHub Security Advisory: GHSA-hr52-f9vp-582c
Package: messagepack-rs (RUST)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-908: Use of Uninitialized Resource
Vulnerable versions: <= 0.8.1
Patched in: unpatched

Summary: Use of Uninitialized Resource in messagepack-rs.

Details:
An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_extension_others may read from uninitialized memory locations.
GitHub Security Advisory: GHSA-jwfh-j623-m97h
Package: messagepack-rs (RUST)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-908: Use of Uninitialized Resource
Vulnerable versions: <= 0.8.1
Patched in: unpatched

Summary: Use of Uninitialized Resource in messagepack-rs

Details:
An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_string may read from uninitialized memory locations.
GitHub Security Advisory: GHSA-6p3c-v8vc-c244
Package: molecule (RUST)
Severity: CRITICAL (CVSS 9.8)
Vulnerable versions: < 0.7.2
Patched in: 0.7.2

Summary: The `total_size` function for partial read the length of any `FixVec` is incorrect in molecule.

Details:
Anyone who uses total_size(..) function to partial read the length of any FixVec will get an incorrect result, due to an incorrect implementation. This has been resolved in the 0.7.2 release.
GitHub Security Advisory: GHSA-2gxj-qrp2-53jv
Package: mopa (RUST)
Severity: CRITICAL (CVSS 9.8)
Vulnerable versions: <= 0.2.2
Patched in: unpatched

Summary: Incorrect reliance on Trait memory layout in mopa

Details:
The mopa crate redefines the deprecated TraitObject struct from core::raw. This is done to then transmute a reference to a trait object (&dyn Trait for any trait Trait) into this struct and retrieve the data field for the purpose of downcasting. This is used to implement downcast_ref_unchecked(), in terms of which downcast_ref() is also implemented. Same goes for mutable reference downcasting and Box downcasting.

The Rust compiler explicitly reserves the right to change the memory layout of &dyn Trait for any trait Trait. The worst case scenario is that it swaps data and vtable, making an executable location breach and compromisation of ASLR possible, since reads from data would read vtable instead. Likewise, arbitrary code execution is also theoretically possible if reads of vtable generated by the compiler read data instead.