advisory-db

GitHub really needs something finer-grain then just pretending the repo never existed during these incidents. [1] The bad package version has also just disappeared from crates.io [2] with no indication its been yanked. There's no security advisory there either [3] "No advisories found for this crate." I feel crates.io was unprepared for a security incident like this since they're managing the response [4] [1]: https://web.archive.org/web/20260820145918/https://github.co... [2]: https://crates.io/crates/arrayref/versions [3]: https://crates.io/crates/arrayref/security (I'd give an Wayback link but that's also broken https://web.archive.org/web/20260820150747/https://crates.io...) [4]: https://github.com/rustsec/advisory-db/issues/3161#issuecomm...

Thread on the post from main rust blog: https://news.ycombinator.com/item?id=49372853 Direct post link: https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on... Initial report: https://github.com/rustsec/advisory-db/issues/3161 Other vendor posts: * https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-... * https://research.jfrog.com/post/arrayref-proc-macro1-crates-... * https://www.aikido.dev/blog/two-popular-rust-crates-arrayref...

https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on... https://github.com/rustsec/advisory-db/issues/3161

https://crates.io/crates/arrayref has a supply chain attack that runs malicious build script through a transient build-time dependency during `cargo build` with https://crates.io/crates/proc-macro-en/1.0.10/ (now deleted) Some more context: https://github.com/rustsec/advisory-db/issues/3161 At the moment I cannot download the payloads anymore for further analysis.

This looks like a really nice feature to see what goes into Rust binaries. This post says that it is experimental, but does not say where it is used. On my Ubuntu VM, it works with bat like the example shows, but does not work with the new Rust "ls": ubuntu@resolute:~$ cargo audit bin /usr/bin/ls Fetching advisory database from `https://github.com/RustSec/advisory-db.git` Loaded 1107 security advisories (from /home/ubuntu/.cargo/advisory-db) Updating crates.io index error: No dependency information found in /usr/bin/ls! Is it a Rust program built with cargo? error: parse error: No dependency information found! Is this a Rust executable built with cargo? ubuntu@resolute:~$ ls -lah /usr/bin/ls lrwxrwxrwx 1 root root 29 Mar 30 16:50 /usr/bin/ls -> ../lib/cargo/bin/coreutils/ls ubuntu@resolute:~$ Still, t

For Rust, the advisory database cargo-audit uses (https://github.com/RustSec/advisory-db/) does track which functions are affected by a cve (if provided). I'm not sure if the tool uses them though.

Related thread: * https://github.com/rustsec/advisory-db/issues/1921 * https://twitter.com/mitsuhiko/status/1772576163371655263

> zero of these bugs will be due to buffer overflows or use after free or other memory bugs in safe rust buffer overflows [0] [1], use after frees [2] [3], and other memory bugs [4] [5] [6] can appear in safe rust from unsound unsafe internals. [0] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2887... [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000... [2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3116... [3] https://github.com/rustsec/advisory-db/blob/main/crates/cros... [4] https://github.com/rustsec/advisory-db/blob/main/crates/toki... [5] https://github.com/rustsec/advisory-db/tree/main/crates/ [6] https://github.com/Qwaz/rust-cve

Hyper 0.11.26 - https://crates.io/crates/hyper/0.11.26 Not yanked. Vulnerable to https://github.com/RustSec/advisory-db/blob/main/crates/hype...

> It's pretty easy to audit a couple lines of unsafe in a library. You have to audit more than just the lines within the unsafe block. For example, I discovered a buffer overflow in a Rust library this week that was caused by an integer overflow outside the unsafe block[1]. The unsafe code itself was written correctly. [1] https://github.com/RustSec/advisory-db/blob/master/crates/ba...