keepawake-0.4.3.crate: 2 vulnerabilities (highest severity is: 9.8)

[mend-bolt-for-github]

Vulnerable Library - keepawake-0.4.3.crate

Path to dependency file: /Cargo.toml

Path to vulnerable library: /Cargo.toml

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (keepawake version)	Remediation Possible**
CVE-2023-45853	Critical	9.8	libz-sys-1.1.9.crate	Transitive	N/A*	❌
CVE-2024-24577	High	8.6	libgit2-sys-0.14.2+1.5.1.crate	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-45853

Vulnerable Library - libz-sys-1.1.9.crate

Low-level bindings to the system libz library (also known as zlib).

Library home page: https://crates.io/api/v1/crates/libz-sys/1.1.9/download

Path to dependency file: /Cargo.toml

Path to vulnerable library: /Cargo.toml

Dependency Hierarchy:

• keepawake-0.4.3.crate (Root Library)
  • shadow-rs-0.21.0.crate
    • git2-0.16.1.crate
      • libgit2-sys-0.14.2+1.5.1.crate
        • ❌ libz-sys-1.1.9.crate (Vulnerable Library)

Found in base branch: master

Vulnerability Details

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.

Publish Date: 2023-10-14

URL: CVE-2023-45853

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://security-tracker.debian.org/tracker/CVE-2023-45853

Release Date: 2023-10-14

Fix Resolution: v1.3.1

Step up your Open Source Security Game with Mend here

CVE-2024-24577

Vulnerable Library - libgit2-sys-0.14.2+1.5.1.crate

Native bindings to the libgit2 library

Library home page: https://crates.io/api/v1/crates/libgit2-sys/0.14.2+1.5.1/download

Path to dependency file: /Cargo.toml

Path to vulnerable library: /Cargo.toml

Dependency Hierarchy:

• keepawake-0.4.3.crate (Root Library)
  • shadow-rs-0.21.0.crate
    • git2-0.16.1.crate
      • ❌ libgit2-sys-0.14.2+1.5.1.crate (Vulnerable Library)

Found in base branch: master

Vulnerability Details

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to git_index_add can cause heap corruption that could be leveraged for arbitrary code execution. There is an issue in the has_dir_name function in src/libgit2/index.c, which frees an entry that should not be freed. The freed entry is later used and overwritten with potentially bad actor-controlled data leading to controlled heap corruption. Depending on the application that uses libgit2, this could lead to arbitrary code execution. This issue has been patched in version 1.6.5 and 1.7.2.

Publish Date: 2024-02-06

URL: CVE-2024-24577

CVSS 3 Score Details (8.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-54mf-x2rh-hq9v

Release Date: 2024-02-06

Fix Resolution: v1.6.5,v1.7.2

Step up your Open Source Security Game with Mend here