https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 19:04:31 +0000 https://vulnerability.circl.lu/vuln/rustsec-2024-0001 <p><strong>Affected:</strong> crates.io: ferris-says</p> <p>Affected versions receive a `&amp;[u8]` from the caller through a safe API, and pass it directly to the unsafe `str::from_utf8_unchecked` function.</p> <p>The behavior of `ferris_says::say` is undefined if the bytes from the caller don&#39;t happen to be valid UTF-8.</p> <p>The flaw was corrected in [ferris-says#21] by using the safe `str::from_utf8` instead, and returning an error on invalid input. However this fix has not yet been published to crates.io as a patch version for 0.2.</p> <p>Separately, [ferris-says#32] has introduced a different API for version 0.3 which accepts input as `&amp;str` rather than `&amp;[u8]`, so is unaffected by this bug.</p> <p>[ferris-says#21]: https://github.com/rust-lang/ferris-says/pull/21 [ferris-says#32]: https://github.com/rust-lang/ferris-says/pull/32</p> <p><strong>Affected:</strong> crates.io: ferris-says</p> <p>Affected versions receive a `&amp;[u8]` from the caller through a safe API, and pass it directly to the unsafe `str::from_utf8_unchecked` function.</p> <p>The behavior of `ferris_says::say` is undefined if the bytes from the caller don&#39;t happen to be valid UTF-8.</p> <p>The flaw was corrected in [ferris-says#21] by using the safe `str::from_utf8` instead, and returning an error on invalid input. However this fix has not yet been published to crates.io as a patch version for 0.2.</p> <p>Separately, [ferris-says#32] has introduced a different API for version 0.3 which accepts input as `&amp;str` rather than `&amp;[u8]`, so is unaffected by this bug.</p> <p>[ferris-says#21]: https://github.com/rust-lang/ferris-says/pull/21 [ferris-says#32]: https://github.com/rust-lang/ferris-says/pull/32</p> https://vulnerability.circl.lu/vuln/rustsec-2024-0001