Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

grin

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5crates.ioPublished

    Grin insufficient data validation

    CVE-2020-15899 · GHSA-p75g-gcv5-42qg

    Affected
    • crates.io grin >= 3.0.0, < 4.0.0
    Fixed in
    4.0.0· Vendor fix available
    Issue
    Grin 3.0.0 before 4.0.0 has insufficient validation of data related to Mimblewimble.

    Recommended action: Upgrade to 4.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 5.3crates.ioPublished

    Grin allows attackers to adversely affect availability of data on a Mimblewimble blockchain

    CVE-2020-12439 · GHSA-6x52-88cq-55q5

    Affected
    • crates.io grin < 3.1.0
    Fixed in
    3.1.0· Vendor fix available
    Issue
    Grin before 3.1.0 allows attackers to adversely affect availability of data on a Mimblewimble blockchain.

    Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  3. High, CVSS 7.5crates.ioPublished

    Grin Insufficient Validation

    CVE-2020-6638 · GHSA-7w6p-rwhg-7h3g

    Affected
    • crates.io grin < 3.0.0
    Fixed in
    3.0.0· Vendor fix available
    Issue
    Grin through 2.1.1 has Insufficient Validation.

    Recommended action: Upgrade to 3.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →