Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The safe API functions constant::Reader::get and StructSchema::new rely on PointerReader::getrootunchecked, which can cause undefined behavior (UB) by constructing arbitrary words or schemas. Reader::get StructSchema::new This vulnerability allows safe Rust code to trigger UB, which violates Rust's safety guarantees. The issue is resolved in version 0.24.0 by making constructor functions unsafe and mark the fields of struct as visible only in the crate.
Recommended action: Upgrade to 0.24.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Cap'n Proto library and capnp Rust package are vulnerable to out-of-bounds read due to logic error handling list-of-list. If a message consumer expects data of type "list of pointers", and if the consumer performs certain specific actions on such data, then a message producer can cause the consumer to read out-of-bounds memory. This could trigger a process crash in the consumer, or in some cases could allow exfiltration of private in-memory data. Impact ====== - Remotely segfault a peer by sending it a malicious message, if the victim performs certain actions on a list-of-pointer type. - Possible exfiltration of memory, if the victim performs additional certain actions on a list-of-pointer type. - To be vulnerable, an application must perform a specific sequence of actions, described below. At present, we are not aware of any vulnerable application, but we advise updating regardless. Fixed in ======== Unfortunately, the bug is present in inlined code, therefore the fix will…
Recommended action: Upgrade to 0.15.2, 0.14.11 or 0.13.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.