最新のセキュリティ情報
10月22日(木)今日
Slack Morphism verifier errors disclose valid HMACs in the logs
影響: rust:slack-morphism >= 1.0.0, <= 2.27.0 → 2.28.0 Summary Slack Morphism exposes the correct Slack request HMAC when signature verification fails. For an invalid request, slack-morphism computes the correct signature for the attacker-controlled timestamp and request body and stores it in SlackEventWrongSignatureError.generated_hash. The error's Debug and Display representations expose that value, and the default Axum listener error handler logs it at error level. An attacker who can both reach the application's Slack callback endpoint and read…
10月20日(火)
russh: Unbounded memory allocation in agent protocol server via crafted constraint records
影響: rust:russh <= 0.64.0 → 0.64.1 Summary russh_keys::agent::server::add_key (russh/src/keys/agent/server.rs:271-319) spawns a dedicated tokio task for every 5-byte SSH_AGENT_CONSTRAIN_LIFETIME record attached to an added key, each cloning the key blob and sleeping for the declared lifetime (up to ~136 years). The loop has no per-request task budget, and spawned tasks are not rolled back when the overall request fails. Repeating one constrained add-key message over an agent connection converts wire bytes into resident tasks and…
10月17日(土)
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
影響: rust:wasmtime-wasi < 24.0.11 → 24.0.11, rust:wasmtime-wasi >= 25.0.0, < 36.0.12 → 36.0.12, rust:wasmtime-wasi >= 37.0.0, < 45.0.3 → 45.0.3, rust:wasmtime-wasi >= 46.0.0, < 46.0.1 → 46.0.1 Summary Wasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite that file by hard-linking it into another preopen that allows file writes. An attacker who can run a WASI guest can bypass WasiCtxBuilder per-preopen FilePerms and modify host files that were exposed as FilePerms::READ. This attack is possible through the wasip1, wasip2, and wasip3 interfaces to the WASI filesystem. This attack is also possible through an indirection of renaming a ha…
lopdf has a stack overflow via deeply nested PDF objects
影響: rust:lopdf < 0.42.0 → 0.42.0 lopdf::Document::load_mem (and the other load entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT. Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting i…