Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

tauri-1.2.4.crate: 5 vulnerabilities (highest severity is: 9.1) #4

Open
mend-bolt-for-github bot opened this issue Jan 1, 2024 · 0 comments
Open

tauri-1.2.4.crate: 5 vulnerabilities (highest severity is: 9.1) #4

mend-bolt-for-github bot opened this issue Jan 1, 2024 · 0 comments
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend

Comments

@mend-bolt-for-github
Copy link
Contributor

mend-bolt-for-github bot commented Jan 1, 2024 •
edited
Loading

Vulnerable Library - tauri-1.2.4.crate

Make tiny, secure apps for all desktop platforms with Tauri

Library home page: https://crates.io/api/v1/crates/tauri/1.2.4/download

Path to dependency file: /src-tauri/Cargo.toml

Path to vulnerable library: /src-tauri/Cargo.toml

Found in HEAD commit: 953dcf744fda3e978ab5c60652575e62240dc959

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (tauri version) Remediation Possible**
WS-2023-0195 Critical 9.1 openssl-0.10.50.crate Transitive N/A* ❌
WS-2023-0366 Medium 6.5 rustix-0.37.11.crate Transitive N/A* ❌
CVE-2024-43806 Medium 6.5 rustix-0.37.11.crate Transitive N/A* ❌
CVE-2024-35222 Medium 5.9 tauri-1.2.4.crate Direct tauri - 1.6.7 ❌
CVE-2023-31134 Medium 4.8 detected in multiple dependencies Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

WS-2023-0195

Vulnerable Library - openssl-0.10.50.crate

OpenSSL bindings

Library home page: https://crates.io/api/v1/crates/openssl/0.10.50/download

Path to dependency file: /src-tauri/Cargo.toml

Path to vulnerable library: /src-tauri/Cargo.toml

Dependency Hierarchy:

  • tauri-1.2.4.crate (Root Library)
    • attohttpc-0.22.0.crate
      • native-tls-0.2.11.crate
        • ❌ openssl-0.10.50.crate (Vulnerable Library)

Found in HEAD commit: 953dcf744fda3e978ab5c60652575e62240dc959

Found in base branch: main

Vulnerability Details

openssl X509VerifyParamRef::set_host buffer over-read

Publish Date: 2024-11-03

URL: WS-2023-0195

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-xcf7-rvmh-g6q4

Release Date: 2023-06-22

Fix Resolution: openssl - 0.10.55

Step up your Open Source Security Game with Mend here

WS-2023-0366

Vulnerable Library - rustix-0.37.11.crate

Safe Rust bindings to POSIX/Unix/Linux/Winsock2-like syscalls

Library home page: https://crates.io/api/v1/crates/rustix/0.37.11/download

Path to dependency file: /src-tauri/Cargo.toml

Path to vulnerable library: /src-tauri/Cargo.toml

Dependency Hierarchy:

  • tauri-1.2.4.crate (Root Library)
    • attohttpc-0.22.0.crate
      • native-tls-0.2.11.crate
        • tempfile-3.5.0.crate
          • ❌ rustix-0.37.11.crate (Vulnerable Library)

Found in HEAD commit: 953dcf744fda3e978ab5c60652575e62240dc959

Found in base branch: main

Vulnerability Details

rustix's rustix::fs::Dir iterator with the linux_raw backend can cause memory explosion

Publish Date: 2023-10-18

URL: WS-2023-0366

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c827-hfw6-qwvm

Release Date: 2023-10-18

Fix Resolution: rustix - 0.35.15,0.36.16,0.37.25,0.38.19

Step up your Open Source Security Game with Mend here

CVE-2024-43806

Vulnerable Library - rustix-0.37.11.crate

Safe Rust bindings to POSIX/Unix/Linux/Winsock2-like syscalls

Library home page: https://crates.io/api/v1/crates/rustix/0.37.11/download

Path to dependency file: /src-tauri/Cargo.toml

Path to vulnerable library: /src-tauri/Cargo.toml

Dependency Hierarchy:

  • tauri-1.2.4.crate (Root Library)
    • attohttpc-0.22.0.crate
      • native-tls-0.2.11.crate
        • tempfile-3.5.0.crate
          • ❌ rustix-0.37.11.crate (Vulnerable Library)

Found in HEAD commit: 953dcf744fda3e978ab5c60652575e62240dc959

Found in base branch: main

Vulnerability Details

Rustix is a set of safe Rust bindings to POSIX-ish APIs. When using rustix::fs::Dir using the linux_raw backend, it's possible for the iterator to "get stuck" when an IO error is encountered. Combined with a memory over-allocation issue in rustix::fs::Dir::read_more, this can cause quick and unbounded memory explosion (gigabytes in a few seconds if used on a hot path) and eventually lead to an OOM crash of the application. The symptoms were initially discovered in imsnif/bandwhich#284. That post has lots of details of our investigation. Full details can be read on the GHSA-c827-hfw6-qwvm repo advisory. If a program tries to access a directory with its file descriptor after the file has been unlinked (or any other action that leaves the Dir iterator in the stuck state), and the implementation does not break after seeing an error, it can cause a memory explosion. As an example, Linux's various virtual file systems (e.g. /proc, /sys) can contain directories that spontaneously pop in and out of existence. Attempting to iterate over them using rustix::fs::Dir directly or indirectly (e.g. with the procfs crate) can trigger this fault condition if the implementation decides to continue on errors. An attacker knowledgeable about the implementation details of a vulnerable target can therefore try to trigger this fault condition via any one or a combination of several available APIs. If successful, the application host will quickly run out of memory, after which the application will likely be terminated by an OOM killer, leading to denial of service. This issue has been addressed in release versions 0.35.15, 0.36.16, 0.37.25, and 0.38.19. Users are advised to upgrade. There are no known workarounds for this issue.

Publish Date: 2024-08-26

URL: CVE-2024-43806

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c827-hfw6-qwvm

Release Date: 2024-08-26

Fix Resolution: rustix - 0.35.15,0.36.16,0.37.25,0.38.19

Step up your Open Source Security Game with Mend here

CVE-2024-35222

Vulnerable Library - tauri-1.2.4.crate

Make tiny, secure apps for all desktop platforms with Tauri

Library home page: https://crates.io/api/v1/crates/tauri/1.2.4/download

Path to dependency file: /src-tauri/Cargo.toml

Path to vulnerable library: /src-tauri/Cargo.toml

Dependency Hierarchy:

  • ❌ tauri-1.2.4.crate (Vulnerable Library)

Found in HEAD commit: 953dcf744fda3e978ab5c60652575e62240dc959

Found in base branch: main

Vulnerability Details

Tauri is a framework for building binaries for all major desktop platforms. Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints without being explicitly allowed in the dangerousRemoteDomainIpcAccess in v1 and in the capabilities in v2. Valid commands with potentially unwanted consequences ("delete project", "transfer credits", etc.) could be invoked by an attacker that controls the content of an iframe running inside a Tauri app. This vulnerability has been patched in versions 1.6.7 and 2.0.0-beta.19.

Publish Date: 2024-05-23

URL: CVE-2024-35222

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-57fm-592m-34r7

Release Date: 2024-05-23

Fix Resolution: tauri - 1.6.7

Step up your Open Source Security Game with Mend here

CVE-2023-31134

Vulnerable Libraries - tauri-runtime-wry-0.12.2.crate, tauri-1.2.4.crate, tauri-runtime-0.12.1.crate

tauri-runtime-wry-0.12.2.crate

Wry bindings to the Tauri runtime

Library home page: https://crates.io/api/v1/crates/tauri-runtime-wry/0.12.2/download

Path to dependency file: /src-tauri/Cargo.toml

Path to vulnerable library: /src-tauri/Cargo.toml

Dependency Hierarchy:

  • tauri-1.2.4.crate (Root Library)
    • ❌ tauri-runtime-wry-0.12.2.crate (Vulnerable Library)

tauri-1.2.4.crate

Make tiny, secure apps for all desktop platforms with Tauri

Library home page: https://crates.io/api/v1/crates/tauri/1.2.4/download

Path to dependency file: /src-tauri/Cargo.toml

Path to vulnerable library: /src-tauri/Cargo.toml

Dependency Hierarchy:

  • ❌ tauri-1.2.4.crate (Vulnerable Library)

tauri-runtime-0.12.1.crate

Runtime for Tauri applications

Library home page: https://crates.io/api/v1/crates/tauri-runtime/0.12.1/download

Path to dependency file: /src-tauri/Cargo.toml

Path to vulnerable library: /src-tauri/Cargo.toml

Dependency Hierarchy:

  • tauri-1.2.4.crate (Root Library)
    • ❌ tauri-runtime-0.12.1.crate (Vulnerable Library)

Found in HEAD commit: 953dcf744fda3e978ab5c60652575e62240dc959

Found in base branch: main

Vulnerability Details

Tauri is software for building applications for multi-platform deployment. The Tauri IPC is usually strictly isolated from external websites, but in versions 1.0.0 until 1.0.9, 1.1.0 until 1.1.4, and 1.2.0 until 1.2.5, the isolation can be bypassed by redirecting an existing Tauri window to an external website. This is either possible by an application implementing a feature for users to visit
arbitrary websites or due to a bug allowing the open redirect. This allows the external website access to the IPC layer and therefore to all configured and exposed Tauri API endpoints and application specific implemented Tauri commands. This issue has been patched in versions 1.0.9, 1.1.4, and 1.2.5. As a workaround, prevent arbitrary input in redirect features and/or only allow trusted websites access to the IPC.

Publish Date: 2023-05-09

URL: CVE-2023-31134

CVSS 3 Score Details (4.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Adjacent
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-31134

Release Date: 2023-05-09

Fix Resolution: tauri - 1.0.9,1.1.4,1.2.5

Step up your Open Source Security Game with Mend here
@mend-bolt-for-github mend-bolt-for-github bot added the Mend: dependency security vulnerability Security vulnerability detected by Mend label Jan 1, 2024
@mend-bolt-for-github mend-bolt-for-github bot changed the title tauri-1.2.4.crate: 4 vulnerabilities (highest severity is: 9.1) tauri-1.2.4.crate: 5 vulnerabilities (highest severity is: 9.1) Aug 27, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
0 participants