keepawake-0.4.3.crate: 5 vulnerabilities (highest severity is: 9.8)

[mend-bolt-for-github]

Vulnerable Library - keepawake-0.4.3.crate

Path to dependency file: /Cargo.toml

Path to vulnerable library: /Cargo.toml

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (keepawake version)	Remediation Possible**
CVE-2023-45853	Critical	9.8	libz-sys-1.1.9.crate	Transitive	N/A*	❌
CVE-2024-24577	High	8.6	libgit2-sys-0.14.2+1.5.1.crate	Transitive	N/A*	❌
WS-2023-0366	Medium	6.5	rustix-0.37.19.crate	Transitive	N/A*	❌
CVE-2024-43806	Medium	6.5	rustix-0.37.19.crate	Transitive	N/A*	❌
CVE-2024-12224	Medium	4.8	idna-0.3.0.crate	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-45853

Vulnerable Library - libz-sys-1.1.9.crate

Low-level bindings to the system libz library (also known as zlib).

Library home page: https://crates.io/api/v1/crates/libz-sys/1.1.9/download

Path to dependency file: /Cargo.toml

Path to vulnerable library: /Cargo.toml

Dependency Hierarchy:

• keepawake-0.4.3.crate (Root Library)
  • shadow-rs-0.21.0.crate
    • git2-0.16.1.crate
      • libgit2-sys-0.14.2+1.5.1.crate
        • ❌ libz-sys-1.1.9.crate (Vulnerable Library)

Found in base branch: master

Vulnerability Details

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.

Publish Date: 2023-10-14

URL: CVE-2023-45853

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://security-tracker.debian.org/tracker/CVE-2023-45853

Release Date: 2023-10-14

Fix Resolution: v1.3.1

Step up your Open Source Security Game with Mend here

CVE-2024-24577

Vulnerable Library - libgit2-sys-0.14.2+1.5.1.crate

Native bindings to the libgit2 library

Library home page: https://crates.io/api/v1/crates/libgit2-sys/0.14.2+1.5.1/download

Path to dependency file: /Cargo.toml

Path to vulnerable library: /Cargo.toml

Dependency Hierarchy:

• keepawake-0.4.3.crate (Root Library)
  • shadow-rs-0.21.0.crate
    • git2-0.16.1.crate
      • ❌ libgit2-sys-0.14.2+1.5.1.crate (Vulnerable Library)

Found in base branch: master

Vulnerability Details

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to git_index_add can cause heap corruption that could be leveraged for arbitrary code execution. There is an issue in the has_dir_name function in src/libgit2/index.c, which frees an entry that should not be freed. The freed entry is later used and overwritten with potentially bad actor-controlled data leading to controlled heap corruption. Depending on the application that uses libgit2, this could lead to arbitrary code execution. This issue has been patched in version 1.6.5 and 1.7.2.

Publish Date: 2024-02-06

URL: CVE-2024-24577

CVSS 3 Score Details (8.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-54mf-x2rh-hq9v

Release Date: 2024-02-06

Fix Resolution: v1.6.5,v1.7.2

Step up your Open Source Security Game with Mend here

WS-2023-0366

Vulnerable Library - rustix-0.37.19.crate

Safe Rust bindings to POSIX/Unix/Linux/Winsock2-like syscalls

Library home page: https://crates.io/api/v1/crates/rustix/0.37.19/download

Path to dependency file: /Cargo.toml

Path to vulnerable library: /Cargo.toml

Dependency Hierarchy:

• keepawake-0.4.3.crate (Root Library)
  • zbus-3.12.0.crate
    • async-io-1.13.0.crate
      • ❌ rustix-0.37.19.crate (Vulnerable Library)

Found in base branch: master

Vulnerability Details

rustix's rustix::fs::Dir iterator with the linux_raw backend can cause memory explosion

Publish Date: 2023-10-18

URL: WS-2023-0366

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c827-hfw6-qwvm

Release Date: 2023-10-18

Fix Resolution: rustix - 0.35.15,0.36.16,0.37.25,0.38.19

Step up your Open Source Security Game with Mend here

CVE-2024-43806

Vulnerable Library - rustix-0.37.19.crate

Safe Rust bindings to POSIX/Unix/Linux/Winsock2-like syscalls

Library home page: https://crates.io/api/v1/crates/rustix/0.37.19/download

Path to dependency file: /Cargo.toml

Path to vulnerable library: /Cargo.toml

Dependency Hierarchy:

• keepawake-0.4.3.crate (Root Library)
  • zbus-3.12.0.crate
    • async-io-1.13.0.crate
      • ❌ rustix-0.37.19.crate (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Rustix is a set of safe Rust bindings to POSIX-ish APIs. When using rustix::fs::Dir using the linux_raw backend, it's possible for the iterator to "get stuck" when an IO error is encountered. Combined with a memory over-allocation issue in rustix::fs::Dir::read_more, this can cause quick and unbounded memory explosion (gigabytes in a few seconds if used on a hot path) and eventually lead to an OOM crash of the application. The symptoms were initially discovered in imsnif/bandwhich#284. That post has lots of details of our investigation. Full details can be read on the GHSA-c827-hfw6-qwvm repo advisory. If a program tries to access a directory with its file descriptor after the file has been unlinked (or any other action that leaves the Dir iterator in the stuck state), and the implementation does not break after seeing an error, it can cause a memory explosion. As an example, Linux's various virtual file systems (e.g. /proc, /sys) can contain directories that spontaneously pop in and out of existence. Attempting to iterate over them using rustix::fs::Dir directly or indirectly (e.g. with the procfs crate) can trigger this fault condition if the implementation decides to continue on errors. An attacker knowledgeable about the implementation details of a vulnerable target can therefore try to trigger this fault condition via any one or a combination of several available APIs. If successful, the application host will quickly run out of memory, after which the application will likely be terminated by an OOM killer, leading to denial of service. This issue has been addressed in release versions 0.35.15, 0.36.16, 0.37.25, and 0.38.19. Users are advised to upgrade. There are no known workarounds for this issue.

Publish Date: 2024-08-26

URL: CVE-2024-43806

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c827-hfw6-qwvm

Release Date: 2024-08-26

Fix Resolution: rustix - 0.35.15,0.36.16,0.37.25,0.38.19

Step up your Open Source Security Game with Mend here

CVE-2024-12224

Vulnerable Library - idna-0.3.0.crate

IDNA (Internationalizing Domain Names in Applications) and Punycode.

Library home page: https://static.crates.io/crates/idna/idna-0.3.0.crate

Path to dependency file: /Cargo.toml

Path to vulnerable library: /Cargo.toml

Dependency Hierarchy:

• keepawake-0.4.3.crate (Root Library)
  • shadow-rs-0.21.0.crate
    • git2-0.16.1.crate
      • url-2.3.1.crate
        • ❌ idna-0.3.0.crate (Vulnerable Library)

Found in base branch: master

Vulnerability Details

"idna" 0.5.0 and earlier accepts Punycode labels that do not produce any non-ASCII output, which means that either ASCII labels or the empty root label can be masked such that they appear unequal without IDNA processing or when processed with a different implementation and equal when processed with "idna" 0.5.0 or earlier.
Concretely, "example.org" and "xn--example-.org" become equal after processing by "idna" 0.5.0 or earlier. Also, "example.org.xn--" and "example.org." become equal after processing by "idna" 0.5.0 or earlier.
In applications using "idna" (but not in "idna" itself) this may be able to lead to privilege escalation when host name comparison is part of a privilege check and the behavior is combined with a client that resolves domains with such labels instead of treating them as errors that preclude DNS resolution / URL fetching and with the attacker managing to introduce a DNS entry (and TLS certificate) for an "xn--"-masked name that turns into the name of the target when processed by "idna" 0.5.0 or earlier.
Remedy
Upgrade to "idna" 1.0.3 or later, if depending on "idna" directly, or to "url" 2.5.4 or later, if depending on "idna" via "url". (This issue was fixed in "idna" 1.0.0, but versions earlier than 1.0.3 are not recommended for other reasons.)
When upgrading, please take a moment to read about "alternative Unicode back ends for "idna"" (https://docs.rs/crate/idna_adapter/latest).
If you are using Rust earlier than 1.81 in combination with SQLx 0.8.2 or earlier, please also read an "issue" (servo/rust-url#992) about combining them with "url" 2.5.4 and "idna" 1.0.3.
Additional information
This issue resulted from "idna" 0.5.0 and earlier implementing the UTS 46 specification literally on this point and the specification having this bug. The specification bug has been fixed in "revision 33 of UTS 46" (https://www.unicode.org/reports/tr46/tr46-33.html#Modifications).
Acknowledgements
Thanks to kageshiron for recognizing the security implications of this behavior.

Publish Date: 2025-02-02

URL: CVE-2024-12224

CVSS 3 Score Details (4.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-h97m-ww89-6jmq

Release Date: 2024-12-09

Fix Resolution: idna - 1.0.0

Step up your Open Source Security Game with Mend here