Most recent entries from osv_rustsec

RUSTSEC-2016-0002 — HTTPS MitM vulnerability due to lack of hostname verification

2023-06-13T13:10:24+00:00

Affected: crates.io: hyper

When used on Windows platforms, all versions of Hyper prior to 0.9.4 did not perform hostname verification when making HTTPS requests.

This allows an attacker to perform MitM attacks by preventing any valid CA-issued certificate, even if there's a hostname mismatch.

The problem was addressed by leveraging rust-openssl's built-in support for hostname verification.

RUSTSEC-2016-0003 — HTTP download and execution allows MitM RCE

2023-06-13T13:10:24+00:00

Affected: crates.io: portaudio

The build script in the portaudio crate will attempt to download via HTTP the portaudio source and build it.

A Mallory in the middle can intercept the download with their own archive and get RCE.

RUSTSEC-2016-0005 — rust-crypto is unmaintained; switch to a modern alternative

2022-01-09T20:07:15+00:00

Affected: crates.io: rust-crypto

The `rust-crypto` crate has not seen a release or GitHub commit since 2016, and its author is unresponsive.

*NOTE: The (old) `rust-crypto` crate (with hyphen) should not be confused with similarly named (new) [RustCrypto GitHub Org] (without hyphen). The GitHub Org is actively maintained.*

We recommend you switch to one of the following crates instead, depending on which algorithms you need:

- [dalek-cryptography GitHub Org]: - Key agreement: [`x25519-dalek`] - Signature algorithms: [`ed25519-dalek`] - [`ring`]: - AEAD algorithms: AES-GCM, ChaCha20Poly1305 - Digest algorithms: SHA-256, SHA-384, SHA-512, SHA-512/256 (legacy: SHA-1) - HMAC - Key agreement: ECDH (P-256, P-384), X25519 - Key derivation: HKDF - Password hashing: PBKDF2 - Signature algorithms: ECDSA (P-256, P-384), Ed25519, RSA (PKCS#1v1.5, PSS) - [RustCrypto GitHub Org]: - AEAD algorithms: [`aes-gcm`], [`aes-gcm-siv`], [`aes-siv`], [`chacha20poly1305`], [`xsalsa20poly1305`] - Block ciphers: [`aes`], [`cast5`], [`des`] - Digest algorithms: [`sha2`], [`sha3`], [`blake2`], [`ripemd160`] (legacy: [`sha-1`], [`md-5`]) - Key derivation: [`hkdf`] - MACs: [`cmac`], [`hmac`], [`pmac`], [`poly1305`] - Password hashing: [`pbkdf2`] - Stream ciphers: [`aes-ctr`], [`chacha20`], [`hc-256`], [`salsa20`] - [`secp256k1`]: - Key agreement: ECDH (secp256k1 only) - Signature algorithms: ECDSA (secp256k1 only) - [`orion`]: - AEAD algorithms: ChaCha20Poly1305 (IETF version), XChaCha20Poly130…

RUSTSEC-2016-0004 — libusb is unmaintained; use rusb instead

2020-10-02T01:29:11+00:00

Affected: crates.io: libusb

The `libusb` crate has not seen a release since September 2016, and its author is unresponsive.

The `rusb` crate is a maintained fork:

https://github.com/a1ien/rusb

RUSTSEC-2016-0001 — SSL/TLS MitM vulnerability due to insecure defaults

2023-06-13T13:10:24+00:00

Affected: crates.io: openssl

All versions of rust-openssl prior to 0.9.0 contained numerous insecure defaults including off-by-default certificate verification and no API to perform hostname verification.

Unless configured correctly by a developer, these defaults could allow an attacker to perform man-in-the-middle attacks.

The problem was addressed in newer versions by enabling certificate verification by default and exposing APIs to perform hostname verification. Use the `SslConnector` and `SslAcceptor` types to take advantage of these new features (as opposed to the lower-level `SslContext` type).

RUSTSEC-2016-0006 — `cassandra` crate is unmaintained; use `cassandra-cpp` instead

2020-10-02T01:29:11+00:00

Affected: crates.io: cassandra

The `cassandra` crate has not seen a release since December 2016, and its author is unresponsive.

The `cassandra-cpp` crate is a maintained fork:

https://github.com/Metaswitch/cassandra-rs

RUSTSEC-2017-0002 — headers containing newline characters can split messages

2023-06-13T13:10:24+00:00

Affected: crates.io: hyper

Serializing of headers to the socket did not filter the values for newline bytes (`\r` or `\n`), which allowed for header values to split a request or response. People would not likely include newlines in the headers in their own applications, so the way for most people to exploit this is if an application constructs headers based on unsanitized user input.

This issue was fixed by replacing all newline characters with a space during serialization of a header value.

RUSTSEC-2017-0001 — scalarmult() vulnerable to degenerate public keys

2023-06-13T13:10:24+00:00

Affected: crates.io: sodiumoxide

The `scalarmult()` function included in previous versions of this crate accepted all-zero public keys, for which the resulting Diffie-Hellman shared secret will always be zero regardless of the private key used.

This issue was fixed by checking for this class of keys and rejecting them if they are used.

RUSTSEC-2017-0003 — Hostname verification skipped when custom root certs used

2023-06-13T13:10:24+00:00

Affected: crates.io: security-framework

If custom root certificates were registered with a `ClientBuilder`, the hostname of the target server would not be validated against its presented leaf certificate.

This issue was fixed by properly configuring the trust evaluation logic to perform that check.

RUSTSEC-2017-0007 — lz4-compress is unmaintained

2020-10-02T01:29:11+00:00

Affected: crates.io: lz4-compress

[According to the developers](https://gitlab.redox-os.org/redox-os/tfs/issues/89) this crate is no longer maintained.

The suggested alternative is [`lz4-compression`](https://crates.io/crates/lz4-compression), a maintained fork of `lz4-compress`.

See also [lz-fear](https://crates.io/crates/lz-fear) which is compatible with the reference LZ4 implementation in C, but not with lz4-compress.