Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
62 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3982-jqvv-277m For more information see the GitHub-hosted security advisory.
Recommended action: Upgrade to 50.0.1, 49.0.5 or 48.0.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-6fr9-xmw9-5352 For more information see the GitHub-hosted security advisory.
Recommended action: Upgrade to 50.0.1, 49.0.5, 48.0.8 or 36.0.20 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-qw58-7h65-crq2 For more information see the GitHub-hosted security advisory.
Recommended action: Upgrade to 50.0.1, 49.0.5 or 48.0.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox. Cranelift was changed in Wasmtime v43 to use a full u32 index, with checks if that limit is exceeded, and so is no longer susceptible to this bug. Impact A Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module. Patches Wasmtime v36.0.19 has been released which fixes this issue.
Recommended action: Upgrade to 43.0.0 or 36.0.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Wasmtime may panic when the host lowers a component model stream or future into a guest, if the host created that stream or future with one payload type and the guest expects a different one. This can happen when an embedder creates a stream or future, passes it through a guest, receives it back under a type-erased type such as StreamAny or FutureAny, and then passes it to a guest function with a different payload type. GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory. Impact This affects embedders that do all of the following: 1. Create streams or futures on the host with StreamReader::new or FutureReader::new 2. Pass them to guest code and receive them back as StreamAny, FutureAny, Val::Stream/Val::Future, or a typed reader whose payload is one of these. 3. Pass them on to a guest function whose stream or future payload type differs from the…
Recommended action: Upgrade to 49.0.4 or 48.0.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one `br_table` instruction in a way that results in an incorrect conditional branch target. This conditional branch could then jump to arbitrary other code (at an user-controlled offset), leading to arbitrary sandbox escapes. Impact Any Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. Patches Wasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue.
Recommended action: Upgrade to 49.0.4, 48.0.7 or 36.0.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5 For more information see the GitHub-hosted security advisory.
Recommended action: Upgrade to 49.0.3 or 48.0.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory.
Recommended action: Upgrade to 49.0.3 or 48.0.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7 For more information see the GitHub-hosted security advisory.
Recommended action: Upgrade to 49.0.3 or 48.0.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory.
Recommended action: Upgrade to 49.0.3 or 48.0.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-54p9-vhhq-8f7q For more information see the GitHub-hosted security advisory.
Recommended action: Upgrade to 49.0.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj For more information see the GitHub-hosted security advisory.
Recommended action: Upgrade to 49.0.3 or 48.0.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g For more information see the GitHub-hosted security advisory.
Recommended action: Upgrade to 49.0.3 or 48.0.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory.
Recommended action: Upgrade to 49.0.3 or 48.0.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp For more information see the GitHub-hosted security advisory.
Recommended action: Upgrade to 49.0.3 or 48.0.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory.
Recommended action: Upgrade to 49.0.3, 48.0.6 or 36.0.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c For more information see the GitHub-hosted security advisory.
Recommended action: Upgrade to 49.0.3 or 48.0.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc For more information see the GitHub-hosted security advisory.
Recommended action: Upgrade to 49.0.3 or 48.0.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Wasmtime's implementation of bulk-data-transfer WebAssembly instructions, such as memory.copy, contains a vulnerability when a preemption via epochs or fuel is combined with altering the store's state or cancelling a computation. To prevent these operations from taking too long Wasmtime injects fuel/epoch checks during these operations, but this enables embedders, and possible WebAssembly, to witness intermediate state in the middle of the operation. Examples of this include: When a non-nullable WebAssembly table is grown the new elements initially start as null and are filled in as part of a loop with preemption checks. If this computation is then cancelled this left the table in a grown-but-uninitialized state where subsequent usage via WebAssembly could possibly segfault. Loads from this table are assumed to not be null due to its type, but the runtime implementation was exposed through this cancellation at a preemption point. Embedders could mutate the store during an…
Recommended action: Upgrade to 47.0.3 or 46.0.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf For more information see the GitHub-hosted security advisory.
Recommended action: Upgrade to 49.0.2 or 48.0.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-cfhf-m2cr-62wj For more information see the GitHub-hosted security advisory.
Recommended action: Upgrade to 49.0.2 or 48.0.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory.
Recommended action: Upgrade to 49.0.2 or 48.0.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m63x-6p34-q65x For more information see the GitHub-hosted security advisory.
Recommended action: Upgrade to 49.0.1 or 48.0.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory.
Recommended action: Upgrade to 49.0.1, 48.0.3 or 36.0.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-x84v-gj2h-g759 For more information see the GitHub-hosted security advisory.
Recommended action: Upgrade to 47.0.4 or 46.0.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.