├── .gitignore ├── .travis.yml ├── LICENSE.txt ├── Cargo.toml ├── crates ├── yaml-rust │ └── RUSTSEC-2018-0006.toml ├── security-framework │ └── RUSTSEC-2017-0003.toml ├── serde_yaml │ └── RUSTSEC-2018-0005.toml ├── sodiumoxide │ └── RUSTSEC-2017-0001.toml ├── cookie │ └── RUSTSEC-2017-0005.toml ├── hyper │ ├── RUSTSEC-2017-0002.toml │ └── RUSTSEC-2016-0002.toml ├── trust-dns-proto │ └── RUSTSEC-2018-0007.toml ├── untrusted │ └── RUSTSEC-2018-0001.toml ├── openssl │ └── RUSTSEC-2016-0001.toml ├── smallvec │ └── RUSTSEC-2018-0003.toml ├── base64 │ └── RUSTSEC-2017-0004.toml ├── claxon │ └── RUSTSEC-2018-0004.toml ├── tar │ └── RUSTSEC-2018-0002.toml └── slice-deque │ └── RUSTSEC-2018-0008.toml ├── src └── main.rs ├── CONTRIBUTING.md ├── CODE_OF_CONDUCT.md └── README.md /.gitignore: -------------------------------------------------------------------------------- 1 | target 2 | Cargo.lock 3 | -------------------------------------------------------------------------------- /.travis.yml: -------------------------------------------------------------------------------- 1 | language: rust 2 | script: cargo run check # check that the advisory-db is well-formed 3 | 4 | branches: 5 | only: 6 | - master 7 | 8 | rust: 9 | - stable 10 | 11 | notifications: 12 | irc: 'irc.mozilla.org#rustsec' 13 | -------------------------------------------------------------------------------- /LICENSE.txt: -------------------------------------------------------------------------------- 1 | All code and data in the RustSec advisory database repository is dedicated to 2 | the public domain: 3 | 4 | https://creativecommons.org/publicdomain/zero/1.0/ 5 | 6 | By committing to this repository, you hereby waive all rights to the work 7 | worldwide under copyright law, including all related and neighboring rights, to 8 | the extent allowed by law. 9 | 10 | You can copy, modify, distribute, and retransmit any information in this 11 | repository, even for commercial purposes, without asking permission. 12 | -------------------------------------------------------------------------------- /Cargo.toml: -------------------------------------------------------------------------------- 1 | [package] 2 | name = "rustsec-advisory-db" 3 | description = "Security advisory database for Rust crates published through crates.io" 4 | version = "0.0.0" 5 | authors = ["Tony Arcieri "] 6 | license-file = "LICENSE.txt" 7 | repository = "https://github.com/rustsec/advisory-db" 8 | documentation = "https://github.com/rustsec/advisory-db" 9 | categories = ["api-bindings", "development-tools"] 10 | keywords = ["rustsec", "security", "advisory", "vulnerability"] 11 | 12 | [[bin]] 13 | name = "rustsec-advisory-db" 14 | 15 | [dependencies] 16 | gumdrop = "0.4" 17 | gumdrop_derive = "0.4" 18 | rustsec = "0.9" 19 | -------------------------------------------------------------------------------- /crates/yaml-rust/RUSTSEC-2018-0006.toml: -------------------------------------------------------------------------------- 1 | [advisory] 2 | id = "RUSTSEC-2018-0006" 3 | package = "yaml-rust" 4 | date = "2018-09-17" 5 | title = "Uncontrolled recursion leads to abort in deserialization" 6 | description = """ 7 | Affected versions of this crate did not prevent deep recursion while 8 | deserializing data structures. 9 | 10 | This allows an attacker to make a YAML file with deeply nested structures 11 | that causes an abort while deserializing it. 12 | 13 | The flaw was corrected by checking the recursion depth. 14 | """ 15 | patched_versions = [">= 0.4.1"] 16 | url = "https://github.com/chyh1990/yaml-rust/pull/109" 17 | keywords = ["crash"] 18 | -------------------------------------------------------------------------------- /crates/security-framework/RUSTSEC-2017-0003.toml: -------------------------------------------------------------------------------- 1 | [advisory] 2 | id = "RUSTSEC-2017-0003" 3 | package = "security-framework" 4 | patched_versions = [">= 0.1.12"] 5 | date = "2017-03-15" 6 | keywords = ["mitm"] 7 | url = "https://github.com/sfackler/rust-security-framework/pull/27" 8 | title = "Hostname verification skipped when custom root certs used" 9 | description = """ 10 | If custom root certificates were registered with a `ClientBuilder`, the 11 | hostname of the target server would not be validated against its presented leaf 12 | certificate. 13 | 14 | This issue was fixed by properly configuring the trust evaluation logic to 15 | perform that check. 16 | """ 17 | -------------------------------------------------------------------------------- /crates/serde_yaml/RUSTSEC-2018-0005.toml: -------------------------------------------------------------------------------- 1 | [advisory] 2 | id = "RUSTSEC-2018-0005" 3 | package = "serde_yaml" 4 | date = "2018-09-17" 5 | title = "Uncontrolled recursion leads to abort in deserialization" 6 | description = """ 7 | Affected versions of this crate did not properly check for recursion 8 | while deserializing aliases. 9 | 10 | This allows an attacker to make a YAML file with an alias referring 11 | to itself causing an abort. 12 | 13 | The flaw was corrected by checking the recursion depth. 14 | """ 15 | patched_versions = [">= 0.8.4"] 16 | unaffected_versions = ["< 0.6.0-rc1"] 17 | url = "https://github.com/dtolnay/serde-yaml/pull/105" 18 | keywords = ["crash"] 19 | -------------------------------------------------------------------------------- /crates/sodiumoxide/RUSTSEC-2017-0001.toml: -------------------------------------------------------------------------------- 1 | [advisory] 2 | id = "RUSTSEC-2017-0001" 3 | package = "sodiumoxide" 4 | patched_versions = [">= 0.0.14"] 5 | aliases = ["CVE-2017-1000168"] 6 | date = "2017-01-26" 7 | keywords = ["cryptography"] 8 | url = "https://github.com/dnaq/sodiumoxide/issues/154" 9 | title = "scalarmult() vulnerable to degenerate public keys" 10 | description = """ 11 | The `scalarmult()` function included in previous versions of this crate 12 | accepted all-zero public keys, for which the resulting Diffie-Hellman shared 13 | secret will always be zero regardless of the private key used. 14 | 15 | This issue was fixed by checking for this class of keys and rejecting them 16 | if they are used. 17 | """ 18 | -------------------------------------------------------------------------------- /crates/cookie/RUSTSEC-2017-0005.toml: -------------------------------------------------------------------------------- 1 | [advisory] 2 | id = "RUSTSEC-2017-0005" 3 | package = "cookie" 4 | patched_versions = ["< 0.6.0", "^0.6.2", ">= 0.7.6"] 5 | keywords = ["crash"] 6 | url = "https://github.com/alexcrichton/cookie-rs/pull/86" 7 | title = "Large cookie Max-Age values can cause a denial of service" 8 | date = "2017-05-06" 9 | description = """ 10 | Affected versions of this crate use the `time` crate and the method 11 | `Duration::seconds` to parse the `Max-Age` duration cookie setting. This method 12 | will panic if the value is greater than 2^64/1000 and less than or equal to 13 | 2^64, which can result in denial of service for a client or server. 14 | 15 | This flaw was corrected by explicitly checking for the `Max-Age` being in this 16 | integer range and clamping the value to the maximum duration value. 17 | """ 18 | -------------------------------------------------------------------------------- /crates/hyper/RUSTSEC-2017-0002.toml: -------------------------------------------------------------------------------- 1 | [advisory] 2 | id = "RUSTSEC-2017-0002" 3 | package = "hyper" 4 | patched_versions = [">= 0.10.2", "< 0.10.0, >= 0.9.18"] 5 | date = "2017-01-23" 6 | url = "https://github.com/hyperium/hyper/wiki/Security-001" 7 | title = "headers containing newline characters can split messages" 8 | description = """ 9 | Serializing of headers to the socket did not filter the values for newline bytes (\r or \n), 10 | which allowed for header values to split a request or response. People would not likely include 11 | newlines in the headers in their own applications, so the way for most people to exploit this 12 | is if an application constructs headers based on unsanitized user input. 13 | 14 | This issue was fixed by replacing all newline characters with a space during serialization of 15 | a header value. 16 | """ 17 | -------------------------------------------------------------------------------- /crates/hyper/RUSTSEC-2016-0002.toml: -------------------------------------------------------------------------------- 1 | [advisory] 2 | id = "RUSTSEC-2016-0002" 3 | package = "hyper" 4 | date = "2016-05-09" 5 | url = "https://github.com/hyperium/hyper/blob/master/CHANGELOG.md#v094-2016-05-09" 6 | title = "HTTPS MitM vulnerability due to lack of hostname verification" 7 | keywords = ["ssl", "mitm"] 8 | affected_os = ["windows"] 9 | patched_versions = [">= 0.9.4"] 10 | references = ["RUSTSEC-2016-0001"] 11 | description = """ 12 | When used on Windows platforms, all versions of Hyper prior to 0.9.4 did not 13 | perform hostname verification when making HTTPS requests. 14 | 15 | This allows an attacker to perform MitM attacks by preventing any valid 16 | CA-issued certificate, even if there's a hostname mismatch. 17 | 18 | The problem was addressed by leveraging rust-openssl's built-in support for 19 | hostname verification. 20 | """ 21 | -------------------------------------------------------------------------------- /crates/trust-dns-proto/RUSTSEC-2018-0007.toml: -------------------------------------------------------------------------------- 1 | [advisory] 2 | id = "RUSTSEC-2018-0007" 3 | package = "trust-dns-proto" 4 | date = "2018-10-09" 5 | title = "Stack overflow when parsing malicious DNS packet" 6 | description = """ 7 | There's a stack overflow leading to a crash when Trust-DNS's parses a 8 | malicious DNS packet. 9 | 10 | Affected versions of this crate did not properly handle parsing of DNS message 11 | compression (RFC1035 section 4.1.4). The parser could be tricked into infinite 12 | loop when a compression offset pointed back to the same domain name to be 13 | parsed. 14 | 15 | This allows an attacker to craft a malicious DNS packet which when consumed 16 | with Trust-DNS could cause stack overflow and crash the affected software. 17 | 18 | The flaw was corrected by trust-dns-proto 0.4.3 and upcoming 0.5.0 release. 19 | """ 20 | patched_versions = [">= 0.4.3", ">= 0.5.0-alpha.3" ] 21 | keywords = [ "stack-overflow", "crash" ] 22 | -------------------------------------------------------------------------------- /crates/untrusted/RUSTSEC-2018-0001.toml: -------------------------------------------------------------------------------- 1 | [advisory] 2 | id = "RUSTSEC-2018-0001" 3 | package = "untrusted" 4 | unaffected_versions = [] 5 | patched_versions = [">= 0.6.2"] 6 | url = "https://github.com/briansmith/untrusted/pull/20" 7 | keywords = ["crash"] 8 | title = "An integer underflow could lead to panic" 9 | date = "2018-06-21" 10 | description = """ 11 | A mistake in error handling in untrusted before 0.6.2 could lead to an integer 12 | underflow and panic if a user of the crate didn't properly check for errors 13 | returned by untrusted. 14 | 15 | Combination of these two programming errors (one in untrusted and another by 16 | user of this crate) could lead to a panic and maybe a denial of service of 17 | affected software. 18 | 19 | The error in untrusted is fixed in release 0.6.2 released 2018-06-21. It's also 20 | advisable that users of untrusted check for their sources for cases where errors 21 | returned by untrusted are not handled correctly. 22 | """ 23 | -------------------------------------------------------------------------------- /crates/openssl/RUSTSEC-2016-0001.toml: -------------------------------------------------------------------------------- 1 | [advisory] 2 | id = "RUSTSEC-2016-0001" 3 | package = "openssl" 4 | patched_versions = [">= 0.9.0"] 5 | date = "2016-11-05" 6 | keywords = ["ssl", "mitm"] 7 | url = "https://github.com/sfackler/rust-openssl/releases/tag/v0.9.0" 8 | title = "SSL/TLS MitM vulnerability due to insecure defaults" 9 | description = """ 10 | All versions of rust-openssl prior to 0.9.0 contained numerous insecure defaults 11 | including off-by-default certificate verification and no API to perform hostname 12 | verification. 13 | 14 | Unless configured correctly by a developer, these defaults could allow an attacker 15 | to perform man-in-the-middle attacks. 16 | 17 | The problem was addressed in newer versions by enabling certificate verification 18 | by default and exposing APIs to perform hostname verification. Use the 19 | `SslConnector` and `SslAcceptor` types to take advantage of these new features 20 | (as opposed to the lower-level `SslContext` type). 21 | """ 22 | -------------------------------------------------------------------------------- /crates/smallvec/RUSTSEC-2018-0003.toml: -------------------------------------------------------------------------------- 1 | [advisory] 2 | id = "RUSTSEC-2018-0003" 3 | package = "smallvec" 4 | unaffected_versions = ["< 0.3.2"] 5 | patched_versions = [">= 0.6.3", "^0.3.4", "^0.4.5", "^0.5.1"] 6 | url = "https://github.com/servo/rust-smallvec/issues/96" 7 | keywords = ["memory-corruption"] 8 | title = "Possible double free during unwinding in SmallVec::insert_many" 9 | date = "2018-07-19" 10 | description = """ 11 | If an iterator passed to `SmallVec::insert_many` panicked in `Iterator::next`, 12 | destructors were run during unwinding while the vector was in an inconsistent 13 | state, possibly causing a double free (a destructor running on two copies of 14 | the same value). 15 | 16 | This is fixed in smallvec 0.6.3 by ensuring that the vector's length is not 17 | updated to include moved items until they have been removed from their 18 | original positions. Items may now be leaked if `Iterator::next` panics, but 19 | they will not be dropped more than once. 20 | 21 | Thank you to @Vurich for reporting this bug. 22 | """ 23 | -------------------------------------------------------------------------------- /crates/base64/RUSTSEC-2017-0004.toml: -------------------------------------------------------------------------------- 1 | [advisory] 2 | id = "RUSTSEC-2017-0004" 3 | package = "base64" 4 | date = "2017-05-03" 5 | url = "https://github.com/alicemaz/rust-base64/commit/24ead980daf11ba563e4fb2516187a56a71ad319" 6 | title = "Integer overflow leads to heap-based buffer overflow in encode_config_buf" 7 | patched_versions = [">= 0.5.2"] 8 | keywords = ["memory-corruption"] 9 | aliases = ["CVE-2017-1000430"] 10 | description = """ 11 | Affected versions of this crate suffered from an integer overflow bug when 12 | calculating the size of a buffer to use when encoding base64 using the 13 | `encode_config_buf` and `encode_config` functions. If the input string 14 | was large, this would cause a buffer to be allocated that was too small. 15 | Since this function writes to the buffer using unsafe code, it would 16 | allow an attacker to write beyond the buffer, causing memory corruption 17 | and possibly the execution of arbitrary code. 18 | 19 | This flaw was corrected by using checked arithmetic to calculate 20 | the size of the buffer. 21 | """ 22 | -------------------------------------------------------------------------------- /crates/claxon/RUSTSEC-2018-0004.toml: -------------------------------------------------------------------------------- 1 | [advisory] 2 | id = "RUSTSEC-2018-0004" 3 | package = "claxon" 4 | date = "2018-08-25" 5 | title = "Malicious input could cause uninitialized memory to be exposed" 6 | description = """ 7 | Affected versions of Claxon made an invalid assumption about the decode buffer 8 | size being a multiple of a value read from the bitstream. This could cause parts 9 | of the decode buffer to not be overwritten. If the decode buffer was newly 10 | allocated and uninitialized, this uninitialized memory could be exposed. 11 | 12 | This allows an attacker to observe parts of the uninitialized memory in the 13 | decoded audio stream. 14 | 15 | The flaw was corrected by checking that the value read from the bistream divides 16 | the decode buffer size, and returning a format error if it does not. If an error 17 | is returned, the decode buffer is not exposed. Regression tests and an 18 | additional fuzzer have been added to prevent similar flaws in the future. 19 | """ 20 | patched_versions = ["=0.3.2", ">= 0.4.1"] 21 | url = "https://github.com/ruuda/claxon/commit/8f28ec275e412dd3af4f3cda460605512faf332c" 22 | keywords = ["uninitialized-memory"] 23 | -------------------------------------------------------------------------------- /crates/tar/RUSTSEC-2018-0002.toml: -------------------------------------------------------------------------------- 1 | [advisory] 2 | id = "RUSTSEC-2018-0002" 3 | package = "tar" 4 | unaffected_versions = [] 5 | patched_versions = [">= 0.4.16"] 6 | keywords = ["file-overwrite"] 7 | url = "https://github.com/alexcrichton/tar-rs/pull/156" 8 | title = "Links in archives can overwrite any existing file" 9 | date = "2018-06-29" 10 | description = """ 11 | When unpacking a tarball with the `unpack_in`-family of functions it's intended 12 | that only files within the specified directory are able to be written. Tarballs 13 | with hard links or symlinks, however, can be used to overwrite any file on the 14 | filesystem. 15 | 16 | Tarballs can contain multiple entries for the same file. A tarball which first 17 | contains an entry for a hard link or symlink pointing to any file on the 18 | filesystem will have the link created, and then afterwards if the same file is 19 | listed in the tarball the hard link will be rewritten and any file can be 20 | rewritten on the filesystem. 21 | 22 | This has been fixed in https://github.com/alexcrichton/tar-rs/pull/156 and is 23 | published as `tar` 0.4.16. Thanks to Max Justicz for discovering this and 24 | emailing about the issue! 25 | """ 26 | -------------------------------------------------------------------------------- /crates/slice-deque/RUSTSEC-2018-0008.toml: -------------------------------------------------------------------------------- 1 | [advisory] 2 | id = "RUSTSEC-2018-0008" 3 | package = "slice-deque" 4 | date = "2018-12-05" 5 | patched_versions = [">= 0.1.16"] 6 | url = "https://github.com/gnzlbg/slice_deque/issues/57" 7 | keywords = ["memory-corruption", "rce"] 8 | title = "Bug in SliceDeque::move_head_unchecked allows read of corrupted memory" 9 | description = """ 10 | 11 | Affected versions of this crate did not properly update the 12 | head and tail of the deque when inserting and removing elements from the front 13 | if, before insertion or removal, the tail of the deque was in the mirrored 14 | memory region, and if, after insertion or removal, the head of the deque is 15 | exactly at the beginning of the mirrored memory region. 16 | 17 | An attacker that controls both element insertion and removal into the deque 18 | could put it in a corrupted state. Once the deque enters such an state, its head 19 | and tail are corrupted, but in bounds of the allocated memory. This can result 20 | in partial reads and writes, reads of uninitialized memory, reads of memory 21 | containing previously dropped objects, etc. An attacker could exploit this to 22 | alter program execution. 23 | 24 | The flaw was corrected by properly updating the head and tail of the deque in 25 | this case. """ 26 | -------------------------------------------------------------------------------- /src/main.rs: -------------------------------------------------------------------------------- 1 | extern crate gumdrop; 2 | #[macro_use] 3 | extern crate gumdrop_derive; 4 | extern crate rustsec; 5 | 6 | use gumdrop::Options; 7 | use rustsec::{AdvisoryDatabase, Repository}; 8 | use std::{env, process::exit}; 9 | 10 | const MIN_EXPECTED_ADVISORIES: usize = 5; 11 | 12 | /// Subcommands 13 | #[derive(Debug, Options)] 14 | enum Opts { 15 | #[options(help = "show help for a command")] 16 | Help(HelpOpts), 17 | 18 | #[options(help = "check the advisory DB is well-formed")] 19 | Check(CheckOpts), 20 | } 21 | 22 | /// Options for the `help` command 23 | #[derive(Debug, Default, Options)] 24 | struct HelpOpts { 25 | #[options(free)] 26 | commands: Vec, 27 | } 28 | 29 | /// Options for the `check` command 30 | #[derive(Debug, Default, Options)] 31 | struct CheckOpts {} 32 | 33 | fn main() { 34 | let args: Vec<_> = env::args().collect(); 35 | 36 | let opts = Opts::parse_args_default(&args[1..]).unwrap_or_else(|e| { 37 | match e.to_string().as_ref() { 38 | // Show usage if no command name is given or if "help" is given 39 | "missing command name" => help(&[]), 40 | string => eprintln!("{}: {}", args[0], string), 41 | } 42 | 43 | exit(2); 44 | }); 45 | 46 | match opts { 47 | Opts::Help(opts) => help(&opts.commands), 48 | Opts::Check(_) => check(), 49 | } 50 | 51 | exit(0); 52 | } 53 | 54 | /// Print help message 55 | fn help(_commands: &[String]) { 56 | println!("Usage: {} [COMMAND] [OPTIONS]", env::args().next().unwrap()); 57 | println!(); 58 | println!("Available commands:"); 59 | println!(); 60 | println!("{}", Opts::command_list().unwrap()); 61 | println!(); 62 | } 63 | 64 | fn check() { 65 | let repo = Repository::open(".").unwrap(); 66 | 67 | // Ensure Advisories.toml parses 68 | let advisory_count = AdvisoryDatabase::from_repository(&repo) 69 | .unwrap() 70 | .advisories() 71 | .count(); 72 | 73 | // Ensure we're parsing some advisories 74 | if advisory_count > MIN_EXPECTED_ADVISORIES { 75 | println!( 76 | "*** Check succeeded! Successfully parsed {} advisories.", 77 | advisory_count 78 | ); 79 | } else { 80 | panic!( 81 | "Missing advisories! Expected at least {}, but got {}", 82 | MIN_EXPECTED_ADVISORIES, advisory_count 83 | ); 84 | } 85 | } 86 | -------------------------------------------------------------------------------- /CONTRIBUTING.md: -------------------------------------------------------------------------------- 1 | # Reporting Vulnerabilities 2 | 3 | To add an advisory to the RustSec database, open a [Pull Request] against 4 | this repository containing the new advisory: 5 | 6 | 1. Create a file named `RUSTSEC-0000-0000.toml` in the `crates/` 7 | subdirectory of this repository (you may need to create it if it doesn't exist) 8 | 2. Copy and paste the [TOML advisory template] from the README.md file in this repo. 9 | Delete the comments and additional whitespace, and fill it out with the 10 | details of the advisory. 11 | 3. Open a [Pull Request]. After being reviewed your advisory will be assigned 12 | a `RUSTSEC-*` advisory identifier and be published to the database. 13 | 4. (Optional, but recommended) Request a CVE for your vulnerability: 14 | https://iwantacve.org/ 15 | 16 | [Pull Request]: https://github.com/RustSec/advisory-db/pulls 17 | [TOML advisory template]: https://github.com/RustSec/advisory-db#advisory-format 18 | 19 | ## Criteria 20 | 21 | RustSec is a database of security vulnerabilities. The following are 22 | examples of qualifying vulnerabilities: 23 | 24 | * Code Execution (i.e. RCE) 25 | * Memory Corruption 26 | * Privilege Escalation (either at OS level or inside of an app/library) 27 | * File Disclosure / Directory Traversal 28 | * Web Security (e.g. XSS, CSRF) 29 | * Format Injection, e.g. shell escaping, SQL injection (and also XSS) 30 | * Cryptography Failure (e.g. confidentiality breakage, integrity breakage, key leakage) 31 | * Covert Channels (e.g. Spectre, Meltdown) 32 | * Panics in code advertised as "panic-free" (particularly if useful for network DoS attacks) 33 | 34 | When in doubt, please open a PR. 35 | 36 | ## FAQ 37 | 38 | **Q: Do I need to be owner of a crate to file an advisory?** 39 | 40 | A: No, anyone can file an advisory against any crate. The legitimacy of 41 | vulnerabilities will be determined prior to merging. If a vulnerability 42 | turns out to be fake it will be removed from the database. 43 | 44 | **Q: Can I file an advisory without creating a pull request?** 45 | 46 | A: Yes, instead of creating a full advisory yourself you can also 47 | [open an issue on the advisory-db repo](https://github.com/RustSec/advisory-db/issues) 48 | or email information about the vulnerability to 49 | [rustsec@googlegroups.com](mailto:rustsec@googlegroups.com). 50 | 51 | **Q: Does this project have a GPG key or other means of handling embargoed vulnerabilities?** 52 | 53 | A: We do not presently handle embargoed vulnerabilities. Please ensure embargoes 54 | have been lifted and details have been disclosed to the public prior to filing 55 | them against RustSec. 56 | -------------------------------------------------------------------------------- /CODE_OF_CONDUCT.md: -------------------------------------------------------------------------------- 1 | # Contributor Covenant Code of Conduct 2 | 3 | ## Our Pledge 4 | 5 | In the interest of fostering an open and welcoming environment, we as 6 | contributors and maintainers pledge to making participation in our project and 7 | our community a harassment-free experience for everyone, regardless of age, body 8 | size, disability, ethnicity, gender identity and expression, level of experience, 9 | nationality, personal appearance, race, religion, or sexual identity and 10 | orientation. 11 | 12 | ## Our Standards 13 | 14 | Examples of behavior that contributes to creating a positive environment 15 | include: 16 | 17 | * Using welcoming and inclusive language 18 | * Being respectful of differing viewpoints and experiences 19 | * Gracefully accepting constructive criticism 20 | * Focusing on what is best for the community 21 | * Showing empathy towards other community members 22 | 23 | Examples of unacceptable behavior by participants include: 24 | 25 | * The use of sexualized language or imagery and unwelcome sexual attention or 26 | advances 27 | * Trolling, insulting/derogatory comments, and personal or political attacks 28 | * Public or private harassment 29 | * Publishing others' private information, such as a physical or electronic 30 | address, without explicit permission 31 | * Other conduct which could reasonably be considered inappropriate in a 32 | professional setting 33 | 34 | ## Our Responsibilities 35 | 36 | Project maintainers are responsible for clarifying the standards of acceptable 37 | behavior and are expected to take appropriate and fair corrective action in 38 | response to any instances of unacceptable behavior. 39 | 40 | Project maintainers have the right and responsibility to remove, edit, or 41 | reject comments, commits, code, wiki edits, issues, and other contributions 42 | that are not aligned to this Code of Conduct, or to ban temporarily or 43 | permanently any contributor for other behaviors that they deem inappropriate, 44 | threatening, offensive, or harmful. 45 | 46 | ## Scope 47 | 48 | This Code of Conduct applies both within project spaces and in public spaces 49 | when an individual is representing the project or its community. Examples of 50 | representing a project or community include using an official project e-mail 51 | address, posting via an official social media account, or acting as an appointed 52 | representative at an online or offline event. Representation of a project may be 53 | further defined and clarified by project maintainers. 54 | 55 | ## Enforcement 56 | 57 | Instances of abusive, harassing, or otherwise unacceptable behavior may be 58 | reported by contacting the project team at bascule@gmail.com. All 59 | complaints will be reviewed and investigated and will result in a response that 60 | is deemed necessary and appropriate to the circumstances. The project team is 61 | obligated to maintain confidentiality with regard to the reporter of an incident. 62 | Further details of specific enforcement policies may be posted separately. 63 | 64 | Project maintainers who do not follow or enforce the Code of Conduct in good 65 | faith may face temporary or permanent repercussions as determined by other 66 | members of the project's leadership. 67 | 68 | ## Attribution 69 | 70 | This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, 71 | available at [http://contributor-covenant.org/version/1/4][version] 72 | 73 | [homepage]: http://contributor-covenant.org 74 | [version]: http://contributor-covenant.org/version/1/4/ 75 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # RustSec Advisory Database 2 | 3 | [![Build Status][build-image]][build-link] 4 | ![Maintained as of December 2018][maintained-image] 5 | [![Gitter Chat][gitter-image]][gitter-link] 6 | 7 | [build-image]: https://travis-ci.org/RustSec/advisory-db.svg?branch=master 8 | [build-link]: https://travis-ci.org/RustSec/advisory-db 9 | [maintained-image]: https://img.shields.io/maintenance/yes/2018.svg 10 | [gitter-image]: https://badges.gitter.im/badge.svg 11 | [gitter-link]: https://gitter.im/RustSec/Lobby 12 | 13 | The RustSec Advisory Database is a repository of security advisories filed 14 | against Rust crates published via https://crates.io 15 | 16 | Advisory metadata is stored in [TOML] format (see below). The following tools 17 | consume the data and can be used for auditing and reporing (send PRs to add yours): 18 | 19 | * [cargo-audit]: Audit `Cargo.lock` files for crates with security vulnerabilities 20 | 21 | [TOML]: https://github.com/toml-lang/toml 22 | [cargo-audit]: https://github.com/rustsec/cargo-audit 23 | 24 | ## Reporting Vulnerabilities 25 | 26 | To report a new vulnerability, open a pull request using the template below. 27 | See [CONTRIBUTING.md] for more information. 28 | 29 | 30 | Report Vulnerability 31 | 32 | 33 | [CONTRIBUTING.md]: https://github.com/RustSec/advisory-db/blob/master/CONTRIBUTING.md 34 | 35 | ## Advisory Format 36 | 37 | Each advisory contains information in [TOML] format: 38 | 39 | ```toml 40 | [advisory] 41 | # Identifier for the advisory (mandatory). Will be assigned a "RUSTSEC-YYYY-NNNN" 42 | # identifier e.g. RUSTSEC-2018-0001. Please use "RUSTSEC-0000-0000" in PRs. 43 | id = "RUSTSEC-0000-0000" 44 | 45 | # Name of the affected crate (mandatory) 46 | package = "mycrate" 47 | 48 | # Disclosure date of the advisory as an RFC 3339 date (mandatory) 49 | date = "2017-02-25" 50 | 51 | # Single-line description of a vulnerability (mandatory) 52 | title = "Flaw in X allows Y" 53 | 54 | # Enter a short-form description of the vulnerability here (mandatory) 55 | description = """ 56 | Affected versions of this crate did not properly X. 57 | 58 | This allows an attacker to Y. 59 | 60 | The flaw was corrected by Z. 61 | """ 62 | 63 | # Versions which include fixes for this vulnerability (mandatory) 64 | patched_versions = [">= 1.2.0"] 65 | 66 | # Versions which were never vulnerable (optional) 67 | #unaffected_versions = ["< 1.1.0"] 68 | 69 | # URL to a long-form description of this issue, e.g. a GitHub issue/PR, 70 | # a change log entry, or a blogpost announcing the release (optional) 71 | url = "https://github.com/mystuff/mycrate/issues/123" 72 | 73 | # Keywords which describe this vulnerability, similar to Cargo (optional) 74 | keywords = ["ssl", "mitm"] 75 | 76 | # Vulnerability aliases, e.g. CVE IDs (optional but recommended) 77 | # Request a CVE for your RustSec vulns: https://iwantacve.org/ 78 | #aliases = ["CVE-2018-XXXX"] 79 | 80 | # References to related vulnerabilities (optional) 81 | # e.g. CVE for a C library wrapped by a -sys crate) 82 | #references = ["CVE-2018-YYYY", "CVE-2018-ZZZZ"] 83 | 84 | # CPU architectures impacted by this vulnerability (optional) 85 | # For a list of CPU architecture strings, see the "platforms" crate: 86 | # 87 | #affected_arch = ["x86", "x86_64"] 88 | 89 | # Operating systems impacted by this vulnerability (optional) 90 | # For a list of OS strings, see the "platforms" crate: 91 | # 92 | #affected_os = ["windows"] 93 | ``` 94 | 95 | ## License 96 | 97 | All content in this repository is placed in the public domain. 98 | 99 | [![Public Domain](http://i.creativecommons.org/p/zero/1.0/88x31.png)](https://github.com/RustSec/advisory-db/blob/master/LICENSE.txt) 100 | --------------------------------------------------------------------------------