dtomvan / aoc Goto Github PK

WS-2023-0027

Vulnerable Library - tokio-1.21.1.crate

An event-driven, non-blocking I/O platform for writing asynchronous I/O backed applications.

Library home page: https://crates.io/api/v1/crates/tokio/1.21.1/download

Dependency Hierarchy:

• xtask-0.1.0.crate (Root Library)
  • reqwest-0.11.11.crate
    • h2-0.3.14.crate
      • ❌ tokio-1.21.1.crate (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A soundness issue was discovered in tokio. tokio::io::ReadHalf::unsplit can violate the Pin contract. Specific set of conditions needed to trigger an issue (a !Unpin type in ReadHalf) is unusual, combined with the difficulty of making any arbitrary use-after-free exploitable in Rust without doing a lot of careful alignment of data types in the surrounding code. The tokio feature io-util is also required to be enabled to trigger this soundness issue.

Publish Date: 2023-02-02

URL: WS-2023-0027

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://rustsec.org/advisories/RUSTSEC-2023-0005.html

Release Date: 2023-02-02

Fix Resolution: tokio - 1.18.5,1.20.4,1.24.2

Step up your Open Source Security Game with Mend here

CVE-2023-22466

Vulnerable Library - tokio-1.21.1.crate

An event-driven, non-blocking I/O platform for writing asynchronous I/O backed applications.

Library home page: https://crates.io/api/v1/crates/tokio/1.21.1/download

Dependency Hierarchy:

• xtask-0.1.0.crate (Root Library)
  • reqwest-0.11.11.crate
    • h2-0.3.14.crate
      • ❌ tokio-1.21.1.crate (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows named pipe server, setting pipe_mode will reset reject_remote_clients to false. If the application has previously configured reject_remote_clients to true, this effectively undoes the configuration. Remote clients may only access the named pipe if the named pipe's associated path is accessible via a publicly shared folder (SMB). Versions 1.23.1, 1.20.3, and 1.18.4 have been patched. The fix will also be present in all releases starting from version 1.24.0. Named pipes were introduced to Tokio in version 1.7.0, so releases older than 1.7.0 are not affected. As a workaround, ensure that pipe_mode is set first after initializing a ServerOptions.

Publish Date: 2023-01-04

URL: CVE-2023-22466

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-7rrj-xr53-82p7

Release Date: 2023-01-04

Fix Resolution: tokio - 1.18.4,1.20.3,1.23.1

Step up your Open Source Security Game with Mend here

Vulnerable Library - bumpalo-3.9.1.crate

A fast bump allocation arena for Rust.

Library home page: https://crates.io/api/v1/crates/bumpalo/3.9.1/download

WS-2023-0006

Vulnerable Library - bumpalo-3.9.1.crate

A fast bump allocation arena for Rust.

Library home page: https://crates.io/api/v1/crates/bumpalo/3.9.1/download

Dependency Hierarchy:

• ❌ bumpalo-3.9.1.crate (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In bumpalo prior to 3.11.1, the lifetime of the iterator produced by Vec::into_iter() is not constrained to the lifetime of the Bump that allocated the vector's memory. Using the iterator after the Bump is dropped causes use-after-free accesses.

Publish Date: 2023-01-14

URL: WS-2023-0006

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://rustsec.org/advisories/RUSTSEC-2022-0078.html

Release Date: 2023-01-14

Fix Resolution: bumpalo - 3.11.1

Step up your Open Source Security Game with Mend here

Vulnerable Library - smallvec-0.6.14.crate

'Small vector' optimization: store up to a small number of items on the stack

Library home page: https://crates.io/api/v1/crates/smallvec/0.6.14/download

Found in HEAD commit: 37a1914151da9b6a8e6a517fd572741380f267ec

CVE-2021-25900

Vulnerable Library - smallvec-0.6.14.crate

'Small vector' optimization: store up to a small number of items on the stack

Library home page: https://crates.io/api/v1/crates/smallvec/0.6.14/download

Dependency Hierarchy:

• ❌ smallvec-0.6.14.crate (Vulnerable Library)

Found in HEAD commit: 37a1914151da9b6a8e6a517fd572741380f267ec

Found in base branch: main

Vulnerability Details

An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.

Publish Date: 2021-01-26

URL: CVE-2021-25900

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-43w2-9j62-hq99

Release Date: 2021-01-26

Fix Resolution: 0.6.14;1.6.1

Step up your Open Source Security Game with Mend here

CVE-2018-25023

Vulnerable Library - smallvec-0.6.14.crate

'Small vector' optimization: store up to a small number of items on the stack

Library home page: https://crates.io/api/v1/crates/smallvec/0.6.14/download

Dependency Hierarchy:

• ❌ smallvec-0.6.14.crate (Vulnerable Library)

Found in HEAD commit: 37a1914151da9b6a8e6a517fd572741380f267ec

Found in base branch: main

Vulnerability Details

An issue was discovered in the smallvec crate before 0.6.13 for Rust. It can create an uninitialized value of any type, including a reference type.

Publish Date: 2021-12-27

URL: CVE-2018-25023

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://rustsec.org/advisories/RUSTSEC-2018-0018.html

Release Date: 2021-12-27

Fix Resolution: smallvec - 0.6.13

Step up your Open Source Security Game with Mend here

WS-2023-0006

Vulnerable Library - bumpalo-3.11.0.crate

A fast bump allocation arena for Rust.

Library home page: https://crates.io/api/v1/crates/bumpalo/3.11.0/download

Dependency Hierarchy:

• aoc_2015-0.1.0 (Root Library)
  • criterion-0.3.6.crate
    • plotters-0.3.4.crate
      • wasm-bindgen-0.2.83.crate
        • wasm-bindgen-macro-0.2.83.crate
          • wasm-bindgen-macro-support-0.2.83.crate
            • wasm-bindgen-backend-0.2.83.crate
              • ❌ bumpalo-3.11.0.crate (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In bumpalo prior to 3.11.1, the lifetime of the iterator produced by Vec::into_iter() is not constrained to the lifetime of the Bump that allocated the vector's memory. Using the iterator after the Bump is dropped causes use-after-free accesses.

Publish Date: 2023-01-14

URL: WS-2023-0006

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://rustsec.org/advisories/RUSTSEC-2022-0078.html

Release Date: 2023-01-14

Fix Resolution: bumpalo - 3.11.1

Step up your Open Source Security Game with Mend here

Vulnerable Library - loc-0.5.0.crate

Found in HEAD commit: ec4ac667443491bb984af30cc4cdbf9787149a61

CVE-2021-25900

Vulnerable Library - smallvec-0.6.14.crate

'Small vector' optimization: store up to a small number of items on the stack

Library home page: https://crates.io/api/v1/crates/smallvec/0.6.14/download

Dependency Hierarchy:

• loc-0.5.0.crate (Root Library)
  • ❌ smallvec-0.6.14.crate (Vulnerable Library)

Found in HEAD commit: ec4ac667443491bb984af30cc4cdbf9787149a61

Found in base branch: main

Vulnerability Details

An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.

Publish Date: 2021-01-26

URL: CVE-2021-25900

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-43w2-9j62-hq99

Release Date: 2021-01-26

Fix Resolution: 0.6.14;1.6.1

Step up your Open Source Security Game with Mend here

CVE-2018-25023

Vulnerable Library - smallvec-0.6.14.crate

'Small vector' optimization: store up to a small number of items on the stack

Library home page: https://crates.io/api/v1/crates/smallvec/0.6.14/download

Dependency Hierarchy:

• loc-0.5.0.crate (Root Library)
  • ❌ smallvec-0.6.14.crate (Vulnerable Library)

Found in HEAD commit: ec4ac667443491bb984af30cc4cdbf9787149a61

Found in base branch: main

Vulnerability Details

An issue was discovered in the smallvec crate before 0.6.13 for Rust. It can create an uninitialized value of any type, including a reference type.

Publish Date: 2021-12-27

URL: CVE-2018-25023

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://rustsec.org/advisories/RUSTSEC-2018-0018.html

Release Date: 2021-12-27

Fix Resolution: smallvec - 0.6.13

Step up your Open Source Security Game with Mend here

Vulnerable Library - criterion-0.3.5.crate

Found in HEAD commit: ec4ac667443491bb984af30cc4cdbf9787149a61

CVE-2022-23639

Vulnerable Library - crossbeam-utils-0.8.5.crate

Utilities for concurrent programming

Library home page: https://crates.io/api/v1/crates/crossbeam-utils/0.8.5/download

Dependency Hierarchy:

• criterion-0.3.5.crate (Root Library)
  • rayon-1.5.1.crate
    • rayon-core-1.9.1.crate
      • crossbeam-deque-0.8.1.crate
        • crossbeam-epoch-0.9.5.crate
          • ❌ crossbeam-utils-0.8.5.crate (Vulnerable Library)

Found in HEAD commit: ec4ac667443491bb984af30cc4cdbf9787149a61

Found in base branch: main

Vulnerability Details

crossbeam-utils provides atomics, synchronization primitives, scoped threads, and other utilities for concurrent programming in Rust. crossbeam-utils prior to version 0.8.7 incorrectly assumed that the alignment of {i,u}64 was always the same as Atomic{I,U}64. However, the alignment of {i,u}64 on a 32-bit target can be smaller than Atomic{I,U}64. This can cause unaligned memory accesses and data race. Crates using fetch_* methods with AtomicCell<{i,u}64> are affected by this issue. 32-bit targets without Atomic{I,U}64 and 64-bit targets are not affected by this issue. This has been fixed in crossbeam-utils 0.8.7. There are currently no known workarounds.

Publish Date: 2022-02-15

URL: CVE-2022-23639

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-qc84-gqf4-9926

Release Date: 2022-02-15

Fix Resolution: crossbeam-utils - 0.8.7

Step up your Open Source Security Game with WhiteSource here