RustSec (@RustSec) profile picture

RustSec

@RustSec

Security advisory database for Rust crates published through https://nitter.gq/t.co/NctFWNHsjG. A project of the @rustsecurecode working group.

rustsec.org
Joined January 2017
  • Tweets148
  • Following16
  • Followers2.4K
9Media
Photo by RustSec (@RustSec)Photo by RustSec (@RustSec)Photo by RustSec (@RustSec)Photo by RustSec (@RustSec)Photo by RustSec (@RustSec)Photo by RustSec (@RustSec)Photo by RustSec (@RustSec)Photo by RustSec (@RustSec)Photo by RustSec (@RustSec)
Growth in the @RustSec security advisory database year-over-year throughout its 6-year history
Image from RustSec (@RustSec)
1
3
16
RustSec retweeted
GitHub (@github) profile picture
GitHub
@github6 Jun 2022
Rust is the fastest growing language on GitHub, and GitHub’s supply chain security features now help keep your Rust projects secure 🔒 github.co/3tiGH9E
GitHub brings supply chain security features to the Rust community

GitHub brings supply chain security features to the Rust community

The Rust community can now discover, report, and prevent security vulnerabilities.

github.blog
5
87
14
289
RustSec retweeted
llogiq (@llogiq) profile picture
llogiq@llogiq14 May 2022
blog.logrocket.com/comparing… Comparing Rust supply chain safety tools
Comparing Rust supply chain safety tools - LogRocket Blog

Comparing Rust supply chain safety tools - LogRocket Blog

These Rust tools will give you a modicum of security for minimal effort and improve the community’s supply chain security.

blog.logrocket.com
2
17
37
A malicious crate was uploaded to crates.io, targeting GitLab CI environments. Read more on the security advisory: blog.rust-lang.org/2022/05/1…
3
147
13
319
The regex crate is vulnerable to denial of service attacks when parsing untrusted regexes (CVE-2022-24713). We released version 1.5.5, fixing the issue. Read the advisory: blog.rust-lang.org/2022/03/0…
2
69
4
227
The std::fs::remove_dir_all function in the Rust standard library is vulnerable to a race condition (CVE-2022-21658). We will release Rust 1.58.1 with the fix later today. Read the advisory: blog.rust-lang.org/2022/01/2…
81
4
311
This is the first year that we've ever seen fewer advisories filed than the previous year! One reason why is because the bulk of advisories for vulnerabilities discovered by the Rudra static code analyzer were filed in 2020 nitter.gq/yechan_bae/status/1453…
Yechan Bae (@yechan_bae) profile pictureYechan Bae@yechan_bae26 Oct 2021
We are very happy to share that Rudra received a distinguished artifact award in SOSP 2021!
Image from Yechan Bae (@yechan_bae)
3
10
Replying to @RustSec @Erstejahre
The crates.io team says to report it to [email protected]
3
Replying to @Erstejahre
From the @RustSec side, you can file an advisory for the affected release so cargo-audit users will see it. If the crate can be reclaimed, the malicious release should be yanked. Beyond that there isn’t a process I’m aware of, but I can ask the crates.io team!
2
3
We have a security advisory for rustc today: blog.rust-lang.org/2021/11/0… We will have a 1.56.1 release out soon.
4
106
26
390
Replying to @pikhq
Correct
The rustsec.org web site now features severity information for each security advisory
Image from RustSec (@RustSec)
Image from RustSec (@RustSec)
3
1
15
Replying to @hdevalence
In programs where certain environment variables are modified from different threads, it can result in memory corruption. This has manifested as programs segfaulting.
2
Probably. We’re discussing it on the #wg-secure-code Zulip channel.
1
3
Unfortunately we don’t have clear guidance for what to do. It impacts several major ecosystem crates including `chrono`. For the latest information, see the upstream issue on `time`: github.com/time-rs/time/issu…
The call to `localtime_r` may be unsound · Issue #293 · time-rs/time

The call to `localtime_r` may be unsound · Issue #293 · time-rs/time

because getenv and setenv are not thread-safe, localtime_r in time may data race with std::env::set_var in libstd. I described this problem in chrono issue, and time is also affected. Edit from @jh...

github.com
2
1
25
This isn’t a false positive, but rather a case where the advisory has been updated to include earlier versions of the `time` crate. Unfortunately the fix is only in `time` v0.2, and it’s unclear if it can be backported to v0.1 due to API constraints.
1
11
Heads up Rustsceans! You might have recently gotten a security vulnerability notification for RUSTSEC-2020-0071: a potential segfault impacting `time` v0.1 (cont’d) rustsec.org/advisories/RUSTS…
1
4
24
My team's first release since I joined GitHub is out today, and my first GitHub blog is live! Thanks so much to the @RustSec community for collaborating to bring curated Rust security advisories to the GitHub Advisory Database! github.blog/2021-09-23-githu…
GitHub Advisory Database now supports Rust

GitHub Advisory Database now supports Rust

The GitHub Advisory Database now includes curated security advisories on the Rust ecosystem!

github.blog
15
1
81
Replying to @RustSec @KodrAus
(we have withdrawn some unmaintained crate advisories, but that was because new maintainers stepped up which is what we’re trying to encourage!)
1
Replying to @KodrAus
As you are seeing, we perform due diligence before publishing unmaintained crate advisories. Agreed we could use a more formal policy, but so far in the course of several years we have not received any complaints about maintained crates being marked unmaintained.
1
1
Load more