vuln-osv update 2026-11-11T12:50:56Z
This commit is contained in:
Vulnerability Bot
File diff suppressed because one or more lines are too long
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19116","published":"2026-11-11T08:34:00Z","modified":"2026-11-11T09:15:03.056260589Z","summary":"Malicious code in humbility-shared (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (bad6120ea5f69f851eafe78dfbb832979077fa6c0175c2bdda88bf073b8ad487)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","affected":[{"package":{"name":"humbility-shared","ecosystem":"PyPI","purl":"pkg:pypi/humbility-shared"},"versions":["0.0.1","0.0.2"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/humbility-shared/MAL-2026-19116.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/humbility-shared"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/GENERIC-standard-pypi-install-pentest/humbility-shared","import_time":"2026-11-11T09:13:15.507864771Z","modified_time":"2026-11-11T08:34:00.054982Z","sha256":"bad6120ea5f69f851eafe78dfbb832979077fa6c0175c2bdda88bf073b8ad487","source":"kam193","versions":["0.0.1","0.0.2"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"PYSEC-2026-4363","published":"2026-11-05T21:18:36.713Z","modified":"2026-11-11T10:00:02.351084890Z","aliases":["CVE-2026-112902","GHSA-xvh5-g6gv-559v"],"details":"Pillow is a Python imaging library. In versions through 12.3.0, the libtiff TIFF encoder can pass arguments to TIFFSetField() that do not match libtiff’s definition of the corresponding tag. When an application saves attacker-controlled image metadata through this encoder, crafted tag values can cause invalid memory reads, copying process memory into the encoded output or crashing the process. Applications that return the encoded output to an attacker can disclose that memory. The issue is reachable when re-saving compressed TIFF images and through certain conversions that preserve EXIF metadata into compressed TIFF output. This vulnerability is fixed in version 13.0.0.","affected":[{"package":{"name":"pillow","ecosystem":"PyPI","purl":"pkg:pypi/pillow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.0"}]}],"versions":["1.0","1.1","1.2","1.3","1.4","1.5","1.6","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","10.0.0","10.0.1","10.1.0","10.2.0","10.3.0","10.4.0","11.0.0","11.1.0","11.2.1","11.3.0","12.0.0","12.1.0","12.1.1","12.2.0","12.3.0","2.0.0","2.1.0","2.2.0","2.2.1","2.2.2","2.3.0","2.3.1","2.3.2","2.4.0","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.8.0","2.8.1","2.8.2","2.9.0","3.0.0","3.1.0","3.1.0.rc1","3.1.0rc1","3.1.1","3.1.2","3.2.0","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.2","4.0.0","4.1.0","4.1.1","4.2.0","4.2.1","4.3.0","5.0.0","5.1.0","5.2.0","5.3.0","5.4.0","5.4.0.dev0","5.4.1","6.0.0","6.1.0","6.2.0","6.2.1","6.2.2","7.0.0","7.1.0","7.1.1","7.1.2","7.2.0","8.0.0","8.0.1","8.1.0","8.1.1","8.1.2","8.2.0","8.3.0","8.3.1","8.3.2","8.4.0","9.0.0","9.0.1","9.1.0","9.1.1","9.2.0","9.3.0","9.4.0","9.5.0"],"ecosystem_specific":{},"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/pillow/PYSEC-2026-4363.yaml"}}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/570df030c0d30c2bf5336b2ab59f3902d8ab0b6d"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/10227"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-xvh5-g6gv-559v"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.0","id":"RUSTSEC-2026-0269","published":"2026-08-20T12:00:00Z","modified":"2026-10-24T06:25:41Z","aliases":["CVE-2026-115392","GHSA-vqjp-4c8c-hfgg"],"summary":"Filesystem sandbox escape when paths or symlinks contain trailing slashes","details":"This is an entry in the RustSec database for the Wasmtime security advisory\nlocated at\nhttps://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg\nFor more information see the GitHub-hosted security advisory.","affected":[{"package":{"name":"wasmtime","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"24.0.13"},{"introduced":"25.0.0"},{"fixed":"36.0.14"},{"introduced":"37.0.0"},{"fixed":"46.0.3"},{"introduced":"47.0.0"},{"fixed":"47.0.4"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":[],"cvss":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0269.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/wasmtime"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0269.html"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/pull/14182"}],"database_specific":{"license":"CC0-1.0"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L"}]}
|
||||
{"schema_version":"1.9.0","id":"RUSTSEC-2026-0269","published":"2026-08-20T12:00:00Z","modified":"2026-11-11T08:57:07.957132502Z","aliases":["CVE-2026-115392","GHSA-vqjp-4c8c-hfgg"],"related":["RUSTSEC-2026-0482"],"summary":"Filesystem sandbox escape when paths or symlinks contain trailing slashes","details":"This is an entry in the RustSec database for the Wasmtime security advisory\nlocated at\nhttps://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg\nFor more information see the GitHub-hosted security advisory.","affected":[{"package":{"name":"wasmtime","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"24.0.13"},{"introduced":"25.0.0"},{"fixed":"36.0.14"},{"introduced":"37.0.0"},{"fixed":"46.0.3"},{"introduced":"47.0.0"},{"fixed":"47.0.4"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":[],"cvss":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0269.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/wasmtime"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0269.html"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/pull/14182"}],"database_specific":{"license":"CC0-1.0"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L"}]}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.0","id":"RUSTSEC-2026-0294","published":"2026-09-18T12:00:00Z","modified":"2026-09-23T03:55:40.049477764Z","aliases":["CVE-2026-92612","GHSA-8mq4-3mwq-qvg6"],"summary":"Unsoundness in UTF-8 'String' trait","details":"The String API in iceoryx2-bb-container exposes its contents as mutable bytes through safe APIs, while String::as_str() converts those bytes into a Rust string slice without validating UTF-8. \nAn application can therefore create an invalid &str and trigger undefined behavior using entirely safe Rust.\n\nThe API methods `as_mut_bytes` and `deref_mut` where removed from the String API and their implementations (PolymorphicString, RelocatableString, and StaticString ) without replacement.\nLink to Pull-Request: https://github.com/eclipse-iceoryx/iceoryx2/pull/1956","affected":[{"package":{"name":"iceoryx2-bb-container","ecosystem":"crates.io","purl":"pkg:cargo/iceoryx2-bb-container"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.10.0"},{"introduced":"0.11.0-0"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":["iceoryx2_bb_container::string::String::as_mut_bytes","iceoryx2_bb_container::string::String::deref_mut","iceoryx2_bb_container::string::polymorphic_string::PolymorphicString::as_mut_bytes","iceoryx2_bb_container::string::polymorphic_string::PolymorphicString::deref_mut","iceoryx2_bb_container::string::relocatable_string::RelocatableString::as_mut_bytes","iceoryx2_bb_container::string::relocatable_string::RelocatableString::deref_mut","iceoryx2_bb_container::string::static_string::StaticString::as_mut_bytes","iceoryx2_bb_container::string::static_string::StaticString::deref_mut"],"os":[]}},"database_specific":{"categories":[],"cvss":null,"informational":"unsound","source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0294.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/iceoryx2-bb-container"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0294.html"},{"type":"WEB","url":"https://github.com/eclipse-iceoryx/iceoryx2/pull/1956"}],"database_specific":{"license":"CC0-1.0"}}
|
||||
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0294","published":"2026-09-18T12:00:00Z","modified":"2026-11-11T10:45:02.509154109Z","aliases":["CVE-2026-92612","GHSA-8mq4-3mwq-qvg6"],"summary":"Unsoundness in UTF-8 'String' trait","details":"The String API in iceoryx2-bb-container exposes its contents as mutable bytes through safe APIs, while String::as_str() converts those bytes into a Rust string slice without validating UTF-8. \nAn application can therefore create an invalid &str and trigger undefined behavior using entirely safe Rust.\n\nThe API methods `as_mut_bytes` and `deref_mut` where removed from the String API and their implementations (PolymorphicString, RelocatableString, and StaticString ) without replacement.\nLink to Pull-Request: https://github.com/eclipse-iceoryx/iceoryx2/pull/1956","affected":[{"package":{"name":"iceoryx2-bb-container","ecosystem":"crates.io","purl":"pkg:cargo/iceoryx2-bb-container"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.10.0"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":["iceoryx2_bb_container::string::String::as_mut_bytes","iceoryx2_bb_container::string::String::deref_mut","iceoryx2_bb_container::string::polymorphic_string::PolymorphicString::as_mut_bytes","iceoryx2_bb_container::string::polymorphic_string::PolymorphicString::deref_mut","iceoryx2_bb_container::string::relocatable_string::RelocatableString::as_mut_bytes","iceoryx2_bb_container::string::relocatable_string::RelocatableString::deref_mut","iceoryx2_bb_container::string::static_string::StaticString::as_mut_bytes","iceoryx2_bb_container::string::static_string::StaticString::deref_mut"],"os":[]}},"database_specific":{"categories":[],"cvss":null,"informational":"unsound","source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0294.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/iceoryx2-bb-container"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0294.html"},{"type":"WEB","url":"https://github.com/eclipse-iceoryx/iceoryx2/pull/1956"}],"database_specific":{"license":"CC0-1.0"}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0480","published":"2026-11-10T12:00:00Z","modified":"2026-11-11T08:45:02.464645086Z","aliases":["CVE-2026-40693","GHSA-gwf2-8595-qw97"],"summary":"Panic on a GCP launch endorsement without TDX measurements","details":"`GcpTdxHost::verify_launch_endorsement()`, available with the `host-gcp-tdx`\nfeature, read `uefi_golden.tdx.measurements[0]` without checking that the\ngolden measurement contains a TDX measurement. If a launch endorsement's\ngolden measurement had no TDX measurements, the call panicked with an index\nout of bounds instead of returning an error.\n\nThe panic is reached only after the endorsement's signing certificate and\nsignature have been verified. Triggering it therefore requires a correctly\nsigned endorsement that lacks TDX measurements.\n\nIntel describes the issue as improper input validation and classifies it as\ndenial of service, with a CVSS 4.0 base score of 5.7, in INTEL-SA-01520.\n\nThe flaw was corrected in\n[#87](https://github.com/IntelLabs/tdx-workload-attestation/pull/87), released\nin 0.2.0. The function now returns `Error::ParseError` when the TDX\nmeasurement structure is missing or empty.\n\nReported by [Borys Tsyrulnikov](https://borystsyrulnikov.dev).","affected":[{"package":{"name":"tdx_workload_attestation","ecosystem":"crates.io","purl":"pkg:cargo/tdx_workload_attestation"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.2.0"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":["tdx_workload_attestation::gcp::GcpTdxHost::verify_launch_endorsement"],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0480.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/tdx_workload_attestation"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0480.html"},{"type":"WEB","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01520.html"},{"type":"WEB","url":"https://github.com/IntelLabs/tdx-workload-attestation/pull/87"},{"type":"WEB","url":"https://github.com/IntelLabs/tdx-workload-attestation/releases/tag/v0.2.0"}],"database_specific":{"license":"CC0-1.0"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0481","published":"2026-11-10T12:00:00Z","modified":"2026-11-11T08:45:02.484411857Z","aliases":["CVE-2026-42067","GHSA-w4mf-755j-wjwc"],"summary":"`verify_x509_cert` does not check the certificate validity period","details":"`tdx_workload_attestation::verification::x509::verify_x509_cert()`, available\nwith the `host-verification` feature, checked that `issuer_cert` issued `cert`\nand verified the certificate signature. It did not check the certificate's\nvalidity period, so it accepted expired and not-yet-valid certificates.\n\nWith the `host-gcp-tdx` feature, this function validates the GCP launch\nendorsement signing certificate against the GCE confidential-computing TCB\nroot certificate. A signing certificate outside its validity period was\ntherefore still accepted during launch endorsement verification.\n\nIntel describes the issue as improper certificate validation and classifies\nit as escalation of privilege, with a CVSS 4.0 base score of 5.9, in\nINTEL-SA-01520.\n\nThe flaw was corrected in\n[#86](https://github.com/IntelLabs/tdx-workload-attestation/pull/86), released\nin 0.2.0. The function now returns `Ok(false)` when the current time is\noutside the certificate's `notBefore`/`notAfter` range.\n\nReported by [Borys Tsyrulnikov](https://borystsyrulnikov.dev).","affected":[{"package":{"name":"tdx_workload_attestation","ecosystem":"crates.io","purl":"pkg:cargo/tdx_workload_attestation"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.2.0"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":["tdx_workload_attestation::verification::x509::verify_x509_cert"],"os":[]}},"database_specific":{"categories":["crypto-failure"],"cvss":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0481.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/tdx_workload_attestation"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0481.html"},{"type":"WEB","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01520.html"},{"type":"WEB","url":"https://github.com/IntelLabs/tdx-workload-attestation/pull/86"},{"type":"WEB","url":"https://github.com/IntelLabs/tdx-workload-attestation/releases/tag/v0.2.0"}],"database_specific":{"license":"CC0-1.0"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0482","published":"2026-08-20T12:00:00Z","modified":"2026-11-11T08:45:02.459487612Z","aliases":["GHSA-hp8f-xmx4-4qrg"],"related":["RUSTSEC-2026-0269"],"summary":"Paths or symlinks ending in a slash escape the sandbox","details":"cap-primitives resolves a path inside a sandboxed directory one component at a time and opens the last component with `O_NOFOLLOW`, so that a symlink there cannot lead out of the directory. When the path ended in `/`, the resolver added the slash back to the last component before opening it. With a trailing slash the operating system no longer treats that component as the last one, so `O_NOFOLLOW` does not apply, the symlink is followed, and the resulting file descriptor was returned without further checks.\n\nA symlink inside the sandbox that points outside it, such as `escape -> ../outside` or a link to `/`, can therefore be opened as `escape/`. If the symlink's own target ends in `/`, the caller's path does not need a trailing slash at all, so removing trailing slashes from untrusted input is not a workaround. The maintainers' advisory reports reads and writes outside the sandbox through `open`, `open_dir`, `read_dir` and `canonicalize`, and directory creation, removal and renames outside it through `create_dir`, `remove_dir` and `rename`.\n\nThis resolver is used on Windows and macOS, on FreeBSD when `O_RESOLVE_BENEATH` is not available, and on Linux when `openat2` is not available (kernels before 5.6, or a seccomp policy that rejects it). cap-std and other crates built on cap-primitives are affected through it. Wasmtime's WASI filesystem support was affected as well; that is covered by RUSTSEC-2026-0269.\n\nThe fix stops re-adding the trailing slash and is in 3.4.6 and 4.0.3.","affected":[{"package":{"name":"cap-primitives","ecosystem":"crates.io","purl":"pkg:cargo/cap-primitives"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"3.4.6"},{"introduced":"4.0.0"},{"fixed":"4.0.3"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["file-disclosure"],"cvss":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0482.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/cap-primitives"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0482.html"},{"type":"WEB","url":"https://github.com/bytecodealliance/cap-std/pull/419"}],"database_specific":{"license":"CC0-1.0"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0483","published":"2026-11-10T12:00:00Z","modified":"2026-11-11T08:45:02.467620273Z","summary":"`lwd-uri-util` was removed from crates.io for malicious code","details":"The `lwd-uri-util` crate exfiltrated SSH keys, AWS credentials, and other\nenvironmental metadata and secrets when any crate using it was built.\n\nThe malicious crate had 8 versions published on 2026-11-09 approximately 12\nhours before removal and had no evidence of actual usage. This crate had no\ndependencies on crates.io.\n\nThanks to [Bitbison](https://bitbison.io/) for the report.","affected":[{"package":{"name":"lwd-uri-util","ecosystem":"crates.io","purl":"pkg:cargo/lwd-uri-util"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["malicious"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0483.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/lwd-uri-util"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0483.html"}],"database_specific":{"license":"CC0-1.0"}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0484","published":"2026-08-11T12:00:00Z","modified":"2026-11-11T08:45:02.464648743Z","aliases":["CVE-2026-20765","GHSA-56j3-r4r2-x3x6"],"summary":"Inverted bitmap validation in `invalidate_l2_cached_ept`","details":"`tdx_guest::tdcall::invalidate_l2_cached_ept()` takes a bitmap that selects the\nL2 VMs whose cached EPT translations should be invalidated. Bits 1 through 3\nselect L2 VMs 1 through 3, and all other bits are reserved. The input check\nwas inverted:\n\n if l2_vm_idx_bitmap & !0b1110 == 0 {\n return Err(TdCallError::TdxOperandInvalid);\n }\n\n`l2_vm_idx_bitmap & !0b1110` isolates the bits that are not allowed. A result\nof zero means the bitmap is valid, and the function returned an error in that\ncase. Every valid bitmap, such as `0b0010` or `0b1110`, was therefore rejected\nwith `TdxOperandInvalid`. Bitmaps with reserved bits set, such as `0b0001` or\n`0b1_0000`, were forwarded to the TDX module.\n\nIntel describes the issue as an incorrect comparison and classifies it as\nescalation of privilege, with a CVSS 4.0 base score of 4.6, in\nINTEL-SA-01462.\n\nThe flaw was corrected in commit\n[`311d33b`](https://github.com/intel/confidential-computing.tdx.tdx-guest/commit/311d33b18a5bef5dc67c9b0c86587dd00c77027e),\nreleased in 0.3.1. The function now rejects an empty bitmap and any bit\noutside `0b1110`.\n\nReported by [Borys Tsyrulnikov](https://borystsyrulnikov.dev).","affected":[{"package":{"name":"tdx-guest","ecosystem":"crates.io","purl":"pkg:cargo/tdx-guest"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.8"},{"fixed":"0.3.1"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":["tdx_guest::tdcall::invalidate_l2_cached_ept"],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0484.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/tdx-guest"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0484.html"},{"type":"WEB","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01462.html"},{"type":"WEB","url":"https://github.com/intel/confidential-computing.tdx.tdx-guest/commit/311d33b18a5bef5dc67c9b0c86587dd00c77027e"},{"type":"WEB","url":"https://borystsyrulnikov.dev/posts/tdx-guest-l2-vm-bugs/"}],"database_specific":{"license":"CC0-1.0"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0485","published":"2026-08-11T12:00:00Z","modified":"2026-11-11T08:45:02.456713599Z","aliases":["CVE-2026-20763","GHSA-wgvc-hf5h-m5h7"],"summary":"`enter_l2_vcpu` passes the wrong RCX operand to `TDG.VP.ENTER`","details":"`tdx_guest::tdcall::enter_l2_vcpu()` invokes the `TDG.VP.ENTER` TDCALL. RCX\nmust carry the L2 VM index in bits 53:52 and the invalidation control value\n(`InvdTranslations`, 0 to 3) in bits 1:0. The function computed that value as\n`(l2_vm_idx << 52) | (invd_translations as u64)`, but then passed the raw\n`l2_vm_idx` in RCX instead.\n\nAs a result, the TDX module received an operand that differs from the\ncaller's request. The VM index field was 0, and the low bits of the index\nwere interpreted as the invalidation control value. For example, VM 1 with\n`InvdTlb` (2) should produce `0x0010_0000_0000_0002`, but produced `0x1`.\n\nIntel describes the issue as an incorrect calculation and classifies it as\nescalation of privilege, with a CVSS 4.0 base score of 4.6, in\nINTEL-SA-01462.\n\nThe flaw was corrected in commit\n[`311d33b`](https://github.com/intel/confidential-computing.tdx.tdx-guest/commit/311d33b18a5bef5dc67c9b0c86587dd00c77027e),\nreleased in 0.3.1, which passes the computed RCX value.\n\nReported by [Borys Tsyrulnikov](https://borystsyrulnikov.dev).","affected":[{"package":{"name":"tdx-guest","ecosystem":"crates.io","purl":"pkg:cargo/tdx-guest"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.8"},{"fixed":"0.3.1"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":["tdx_guest::tdcall::enter_l2_vcpu"],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0485.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/tdx-guest"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0485.html"},{"type":"WEB","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01462.html"},{"type":"WEB","url":"https://github.com/intel/confidential-computing.tdx.tdx-guest/commit/311d33b18a5bef5dc67c9b0c86587dd00c77027e"},{"type":"WEB","url":"https://borystsyrulnikov.dev/posts/tdx-guest-l2-vm-bugs/"}],"database_specific":{"license":"CC0-1.0"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0486","published":"2026-10-27T12:00:00Z","modified":"2026-11-11T08:45:02.466292839Z","aliases":["GHSA-jh2m-fhpj-3vr7"],"summary":"xattr functions mark unwritten bytes as initialized when given a zero-length buffer","details":"The extended-attribute functions in `rustix::fs` (`getxattr`, `lgetxattr`, `fgetxattr`, `listxattr`, `llistxattr` and `flistxattr`) write into a `Buffer` and then mark as many bytes initialized as the system call reported. When the buffer has zero length, the operating system treats the call as a size query: it writes nothing and returns the size of the attribute value or of the name list. rustix still marked that many bytes as initialized.\n\nPassing a `Vec` whose length equals its capacity through `spare_capacity` gives such a zero-length buffer, and rustix then set the vector's length past its capacity over memory that was never written. This is undefined behavior reachable from safe code. With an empty `&mut [MaybeUninit<u8>]` the call panics instead.\n\nFrom 1.1.6 these functions return an empty result for a zero-length buffer, and new `getxattr_query`, `lgetxattr_query`, `fgetxattr_query`, `listxattr_query`, `llistxattr_query` and `flistxattr_query` functions return the size. The 0.38 series did not have the `Buffer` API and is not affected.","affected":[{"package":{"name":"rustix","ecosystem":"crates.io","purl":"pkg:cargo/rustix"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.1.6"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":["rustix::fs::fgetxattr","rustix::fs::flistxattr","rustix::fs::getxattr","rustix::fs::lgetxattr","rustix::fs::listxattr","rustix::fs::llistxattr"],"os":[]}},"database_specific":{"categories":[],"cvss":null,"informational":"unsound","source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0486.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/rustix"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0486.html"},{"type":"WEB","url":"https://github.com/bytecodealliance/rustix/commit/8e6aaa6713d2bb64b1fdd8c472e3a32a10a76d70"}],"database_specific":{"license":"CC0-1.0"}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0487","published":"2026-09-03T12:00:00Z","modified":"2026-11-11T12:30:02.446157507Z","aliases":["GHSA-hx8c-fjhc-hmf5"],"summary":"Panic on a malformed `alpn` value when parsing SVCB or HTTPS records from text","details":"When an SVCB or HTTPS record is parsed from its text (zone file) form, the `alpn` service parameter value is split into a list of protocol names. That step called `expect` on the result, on the assumption that it could not fail. A malformed value, such as one with an unbalanced quote (`alpn=\"h`), two commas in a row or an invalid escape, makes it fail, so the parser panicked instead of returning an error.\n\nCode that parses zone files or record text from an untrusted source can be made to panic, which is a denial of service. Records decoded from the DNS wire format are not parsed this way.\n\nThe fix returns a parse error instead. It is in 0.26.2.","affected":[{"package":{"name":"hickory-proto","ecosystem":"crates.io","purl":"pkg:cargo/hickory-proto"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.20.1"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0487.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-proto"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0487.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/80eaf9e79f7561e2bc1cf5b89eaba7fd25de3284"}],"database_specific":{"license":"CC0-1.0"}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0488","published":"2026-09-03T12:00:00Z","modified":"2026-11-11T12:30:02.896196450Z","aliases":["GHSA-x962-5xwx-fr8x"],"summary":"Integer underflow when reporting a malformed TSIG record","details":"When a TSIG record is decoded from the DNS wire format, its MAC length and \"other data\" length are checked against the end of the record data. If a check failed, the error value was built from `end_idx - decoder.index()`. For a malformed record the decoder can already be past `end_idx`, so this unsigned subtraction underflows.\n\nIn builds with overflow checks enabled (the `dev` profile by default) the underflow panics, so a peer that sends a crafted TSIG record can crash the process. In builds without overflow checks the result wraps and is only used in the returned error.\n\nThe fix returns a plain \"insufficient bytes\" error without the subtraction. It is in 0.26.2.","affected":[{"package":{"name":"hickory-proto","ecosystem":"crates.io","purl":"pkg:cargo/hickory-proto"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.26.0"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0488.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-proto"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0488.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/b1246a8a21b6dcc34d427a7d39dd96e10825c384"}],"database_specific":{"license":"CC0-1.0"}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0489","published":"2026-09-03T12:00:00Z","modified":"2026-11-11T12:30:02.444925481Z","aliases":["GHSA-wgfr-mphw-j5g4"],"summary":"Panic when an SVCB or HTTPS parameter value is a single quote character","details":"When an SVCB or HTTPS record is parsed from its text (zone file) form, surrounding double quotes are removed from each service parameter value by checking that the value starts and ends with `\"` and slicing off the first and last character. A value that is a single `\"` (for example `alpn=\"`) passes that check, and the slice `[1..0]` panics.\n\nCode that parses zone files or record text from an untrusted source can be made to panic, which is a denial of service. Records decoded from the DNS wire format are not parsed this way.\n\nThe fix rejects a lone quote character with a parse error before the slice. It is in 0.26.2.","affected":[{"package":{"name":"hickory-proto","ecosystem":"crates.io","purl":"pkg:cargo/hickory-proto"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.20.1"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0489.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-proto"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0489.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/c663b60a4b4b98deb45d16ccbf10ce2f76cd88a9"}],"database_specific":{"license":"CC0-1.0"}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0490","published":"2026-09-03T12:00:00Z","modified":"2026-11-11T12:41:09.446683259Z","aliases":["CVE-2026-123574","GHSA-4rph-pmrw-mwpw"],"summary":"Zone file lexer panics on a token of 4096 or more characters","details":"The zone file lexer read each token in a loop capped at 4,096 iterations, with an `assert!` on the loop counter as a safety bound. A single token long enough to reach that bound, for example a very long name or character string in a zone file, triggered the assertion and the parser panicked instead of returning the token or an error.\n\nCode that parses zone files from an untrusted source can be made to panic, which is a denial of service.\n\nThe fix removes the iteration bound, so the lexer ends only when it reaches the end of a token or an error. It is in 0.26.2.","affected":[{"package":{"name":"hickory-proto","ecosystem":"crates.io","purl":"pkg:cargo/hickory-proto"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.24.0"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0490.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-proto"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0490.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/0494e15c88fba612f9ecb4f013eb3b221822c867"}],"database_specific":{"license":"CC0-1.0"}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0491","published":"2026-09-03T12:00:00Z","modified":"2026-11-11T12:30:02.901694858Z","aliases":["GHSA-67wc-6jq8-ghrc"],"summary":"Memory amplification from record counts in the DNS message header","details":"When a DNS message is decoded, the vectors for the question, answer, authority and additional sections were created with `Vec::with_capacity` set to the counts in the message header. Those counts come from the sender and are not checked against the size of the message, so a single small packet that claims 65,535 records makes the decoder reserve memory for that many records (about 18 MB, according to the upstream advisory) before it reads any record and fails.\n\nAny code that decodes untrusted DNS messages is exposed. That includes servers, and clients and resolvers that receive spoofed responses. Repeated packets can drive memory use up and cause a denial of service.\n\nThe fix caps the initial capacity at 8 entries and lets the vectors grow as records are actually decoded. It is in 0.26.2.","affected":[{"package":{"name":"hickory-proto","ecosystem":"crates.io","purl":"pkg:cargo/hickory-proto"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.18.0"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0491.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-proto"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0491.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/280c0e5c4e3002d73ba0762835ef82272d1d33a6"}],"database_specific":{"license":"CC0-1.0"}}
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18794","published":"2026-11-09T16:53:31Z","modified":"2026-11-09T17:30:04.034135352Z","aliases":["GHSA-p9gj-xrcq-w5rc"],"summary":"Malicious code in dsh-ungate (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (a660f4353216e548bc40977463bcd181435354a0aed48c8c6f5166f684061176)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"dsh-ungate","ecosystem":"npm","purl":"pkg:npm/dsh-ungate"},"versions":["0.2.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dsh-ungate/MAL-2026-18794.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-p9gj-xrcq-w5rc"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-p9gj-xrcq-w5rc","import_time":"2026-11-09T17:18:22.621460806Z","modified_time":"2026-11-09T16:54:01Z","sha256":"a660f4353216e548bc40977463bcd181435354a0aed48c8c6f5166f684061176","source":"ghsa-malware","versions":["0.2.3"]}]}}
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-18794","published":"2026-11-09T16:53:31Z","modified":"2026-11-11T07:30:07.877574058Z","aliases":["GHSA-p9gj-xrcq-w5rc"],"summary":"Malicious code in dsh-ungate (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (a660f4353216e548bc40977463bcd181435354a0aed48c8c6f5166f684061176)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"dsh-ungate","ecosystem":"npm","purl":"pkg:npm/dsh-ungate"},"versions":["0.2.3","0.2.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dsh-ungate/MAL-2026-18794.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-p9gj-xrcq-w5rc"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-p9gj-xrcq-w5rc","import_time":"2026-11-09T17:18:22.621460806Z","modified_time":"2026-11-09T16:54:01Z","sha256":"a660f4353216e548bc40977463bcd181435354a0aed48c8c6f5166f684061176","source":"ghsa-malware","versions":["0.2.3"]},{"id":"GHSA-p9gj-xrcq-w5rc","import_time":"2026-11-11T07:18:44.970344723Z","modified_time":"2026-11-11T06:45:10Z","sha256":"38bfa4e95a344ec7c217f8aee7bf88163fc24d2983f1804c612cebb625b457b5","source":"ghsa-malware","versions":["0.2.4","0.2.3"]}]}}
|
||||
@@ -0,0 +1 @@
|
||||
{"schema_version":"1.9.2","id":"MAL-2026-19118","published":"2026-11-11T12:09:02Z","modified":"2026-11-11T12:30:04.004300065Z","aliases":["GHSA-9j97-6pqr-qvrx"],"summary":"Malicious code in 0sec-cli (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (6ca0694213fab27d0292d43aee954b81c13e551a81563903fb9afd7e54a9dda2)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"0sec-cli","ecosystem":"npm","purl":"pkg:npm/0sec-cli"},"versions":["0.28.10"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/0sec-cli/MAL-2026-19118.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9j97-6pqr-qvrx"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-9j97-6pqr-qvrx","import_time":"2026-11-11T12:23:59.195275939Z","modified_time":"2026-11-11T12:09:02Z","sha256":"6ca0694213fab27d0292d43aee954b81c13e551a81563903fb9afd7e54a9dda2","source":"ghsa-malware","versions":["0.28.10"]}]}}
|
||||
Reference in New Issue
Block a user