rustsec/advisory-db
1
0
Fork 0
mirror of https://github.com/rustsec/advisory-db.git synced 2026-09-17 05:29:29 -05:00
Code Issues Packages Projects Releases Wiki Activity
2,470 Commits 28 Branches 0 Tags
rip-groups
Commit Graph
2470 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirkjan Ochtman cde2171bde Remove mention of Google Group from CONTRIBUTING 2025-06-16 11:58:16 +02:00
github-actions[bot]anddjc eaef7f63c3 Assigned RUSTSEC-2025-0041 to matrix-sdk-crypto (#2333) 
Co-authored-by: djc <158471+djc@users.noreply.github.com>
 2025-06-12 11:17:43 +02:00
Damir JelićandDenis Kasak 752b7c66e7 Add CVE-2025-48937 to matrix-sdk-crypto (#2332) 
Co-authored-by: Denis Kasak <dkasak@termina.org.uk>
 2025-06-12 11:16:58 +02:00
djc a1f651cba8 Assigned RUSTSEC-2025-0040 to users 2025-06-03 13:30:36 +02:00
Daniel Thwaites 0c55633e33 Report incorrect group information in users 2025-06-03 13:29:51 +02:00
djc d3b9244290 Assigned RUSTSEC-2025-0039 to anon-vec 2025-06-02 09:46:01 +02:00
Shihao Xia 9c71181231 anon-vec: insufficient checks in public API 2025-06-02 09:43:07 +02:00
djc 7727c950e4 Assigned RUSTSEC-2025-0038 to arrow2 2025-05-30 17:33:12 +02:00
Shihao Xia 6ddb39205b arrow2: unchecked out of bounds memory access 2025-05-30 17:31:56 +02:00
github-actions[bot]andShnatsel bccf313a98 Assigned RUSTSEC-2025-0037 to pingora-core (#2323) 
Co-authored-by: Shnatsel <291257+Shnatsel@users.noreply.github.com>
 2025-05-22 19:04:33 +01:00
Noah KennedyandSergey Shnatsel Davidoff ed30d211da pingora request smuggling and cache poisoning (#2322) 
* pingora request smuggling and cache poisoning

Pingora has a request smuggling and cache poisoning vulnerability
affecting versions 0.5.0 and older, as documented here:
https://blog.cloudflare.com/resolving-a-request-smuggling-vulnerability-in-pingora/

* cleanup comments

* add cvss

* cve id not published yet, no formal cvss

* change to pingora-core

* cve published

* typo

* typo

* h1

* remove cvss again

* drop unused categories field and comments

---------

Co-authored-by: Sergey "Shnatsel" Davidoff <shnatsel@gmail.com>
 2025-05-22 19:03:43 +01:00
djc f16bc63290 Assigned RUSTSEC-2025-0036 to surf 2025-05-17 15:43:35 +02:00
Fabio Valentini bbd44567c6 add unmaintained advisory for surf 2025-05-17 15:34:03 +02:00
djc 982c2320aa Assigned RUSTSEC-2025-0035 to macroquad 2025-05-14 22:55:51 +02:00
Maja Kądziołka ea20d510da Add advisory for macroquad 2025-05-14 22:17:29 +02:00
djc 796d034fbc Assigned RUSTSEC-2025-0034 to fast_id_map 2025-05-08 09:32:19 +02:00
Shihao XiaandDirkjan Ochtman fa0e56df73 Update crates/fast_id_map/RUSTSEC-0000-0000.md 
Co-authored-by: Dirkjan Ochtman <dirkjan@ochtman.nl>
 2025-05-08 09:15:04 +02:00
Shihao Xia ed0fe0b396 init 2025-05-08 09:15:04 +02:00
djc c542133786 Assigned RUSTSEC-2025-0033 to scanner 2025-05-07 10:32:09 +02:00
Shihao Xia 2be585eca3 scanner-rs OOB read (#2262) 2025-05-07 10:17:05 +02:00
Speykious 6c750492d5 RUSTSEC-2025-0028: Indicate 'cve-rs' is a joke 2025-05-06 23:08:48 +02:00
Benjamin Herr 91f650dad5 RUSTSEC-2025-0030: Indicate 'totally-safe-transmute' is a toy. 
People should know that totally-safe-transmute is a toy that's
intentionally doing broken things, so that

a) they don't come after me

b) they know not to expect it to get patched

c) they question why someone is pulling toy code into their dependencies
 2025-05-06 22:14:30 +02:00
Dirkjan Ochtman 59287b791e Adjust patched versions in mp3-metadata advisory 2025-05-06 21:24:32 +02:00
djc 47e5b84a89 Assigned RUSTSEC-2025-0032 to redox_uefi_std 2025-05-06 18:12:33 +02:00
Shihao Xia 256a207941 Out of bounds read in redux_uefi_std (#2263) 2025-05-06 18:11:10 +02:00
djc 10cda9b8b6 Assigned RUSTSEC-2025-0031 to tanton_engine 2025-05-06 10:40:57 +02:00
Shihao Xia 79680cff59 tanton_engine: unsound public API (#2286) 2025-05-06 10:27:52 +02:00
djc 4f92672f2e Assigned RUSTSEC-2025-0028 to cve-rs, RUSTSEC-2025-0029 to totally-safe, RUSTSEC-2025-0030 to totally-safe-transmute 2025-05-05 20:31:28 +02:00
Nugine bb435cce9a Report unsoundness in cve-rs, totally-safe-transmute and totally-safe (#2221) 2025-05-05 20:16:50 +02:00
djc 4584ad9a5e Assigned RUSTSEC-2023-0090 to wasmtime, RUSTSEC-2022-0095 to wasmtime, RUSTSEC-2022-0096 to wasmtime, RUSTSEC-2022-0097 to wasmtime, RUSTSEC-2023-0091 to wasmtime, RUSTSEC-2022-0098 to wasmtime, RUSTSEC-2022-0099 to wasmtime, RUSTSEC-2023-0092 to wasmtime, RUSTSEC-2024-0438 to wasmtime, RUSTSEC-2024-0439 to wasmtime, RUSTSEC-2024-0440 to wasmtime, RUSTSEC-2024-0441 to wasmtime, RUSTSEC-2022-0100 to wasmtime, RUSTSEC-2022-0101 to wasmtime, RUSTSEC-2023-0093 to wasmtime, RUSTSEC-2022-0102 to wasmtime 2025-05-02 10:23:27 +02:00
Alex Crichton 669a9580ac Import old Wasmtime security advisories 
[Wasmtime] recently got a [request] to have our security advisories
published on the RustSec database as well. We've got a few old
advisories on here but we haven't been keeping up-to-date with later
advisories. In lieu of automatic imports from GitHub to RustSec we
figured we'd in the interim manually fill in some fields.

In this PR I'm back-filling security advisories we've had in Wasmtime
into the RustSec database here. The oldest advisory here is 3 years old
and the goal is to have this serve as a template for importing future
advisories that Wasmtime gets. It's not expected for this to cause any
churn or undue warnings but instead is intended to bring RustSec
up-to-date with the advisories we have for this crate.

[Wasmtime]: https://crates.io/crates/wasmtime
[request]: https://github.com/bytecodealliance/wasmtime/issues/10344
 2025-05-02 10:20:16 +02:00
Dirkjan Ochtman f91c52b97d Install rustsec from git (#2299) 2025-05-01 08:40:54 -06:00
djc dde35430a1 Assigned RUSTSEC-2025-0027 to mp3-metadata 2025-04-30 14:13:20 +02:00
Zeyang Zhuang 93640644aa Add advisory for index error in mp3-metadata 2025-04-30 14:11:42 +02:00
djc d63efe8c21 Assigned RUSTSEC-2023-0089 to atomic-polyfill 2025-04-29 10:31:10 +02:00
Ossi Herrala a19c530731 Advisory for unmaintained atomic-polyfill 2025-04-29 10:29:54 +02:00
djc d4d4e1bb04 Assigned RUSTSEC-2025-0026 to registry 2025-04-29 10:11:21 +02:00
Ossi Herrala ebe0bda527 Advisory for unmaintained registry 2025-04-29 10:10:13 +02:00
djc 49a83cd6c8 Assigned RUSTSEC-2025-0025 to rustc-serialize 2025-04-28 15:38:14 +02:00
Zeyang Zhuang b5862af7b5 Add unmaintained advisory for rustc-serialize 2025-04-28 15:37:12 +02:00
Samuel Moelius 04f73c5360 Withdraw RUSTSEC-2022-0044 2025-04-28 12:35:27 +02:00
github-actions[bot]anddjc 1273f0099c Assigned RUSTSEC-2025-0024 to crossbeam-channel (#2278) 
Co-authored-by: djc <158471+djc@users.noreply.github.com>
 2025-04-10 14:29:37 +02:00
Ian Jackson ce8badfec8 Add crossbeam-channel advisory re upstream MR #1187 (#2277) 2025-04-10 14:26:35 +02:00
Alice Ryhl fcb34000ec Update patched version list for RUSTSEC-2025-0023 2025-04-08 11:12:03 +02:00
Eliah Kagan 86d8f383bb Add references to RUSTSEC-2025-0021 
Since it was added in #2268, RUSTSEC-2025-0021 (CVE-2025-31130) has
an entry in the GitHub Advisory Database. As planned in #2268, this
adds the link to that global GHSA, as well as to the National
Vulnerability Database entry for the CVE.
 2025-04-08 09:10:04 +02:00
github-actions[bot] b3d5d51745 Assigned RUSTSEC-2025-0023 to tokio (#2273) 2025-04-07 09:45:16 +02:00
Alice Ryhl 4f618e7f7f Add unsound advisory for Tokio 7232 (#2272) 2025-04-07 09:40:44 +02:00
Alex Gaynor f1688a2f9a Change our policy from 90 days to 270 days for unmaintained (#2032) 2025-04-05 16:51:10 +02:00
github-actions[bot]andalex 1701df31f7 Assigned RUSTSEC-2025-0022 to openssl (#2271) 
Co-authored-by: alex <772+alex@users.noreply.github.com>
 2025-04-04 09:49:29 -04:00
Alex Gaynor 58acd2928d Added rustsec advisory for two UAFs in rust-openssl (#2270) 2025-04-04 09:49:00 -04:00