rustfs (crates.io)
Advisories
13
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.0.0-alpha.98 or later clears every advisory below that has a fix.
Upgrade commands
cargo
cargo update -p rustfs --precise 1.0.0-alpha.98Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-mm2q-qcmx-gw4w RustFS: ListServiceAccount authorizes against wrong admin action, enabling cross-user enumeration and root service account takeover |
High | < 1.0.0-alpha.98 | 1.0.0-alpha.98 |
| GHSA-pfcq-4gjr-6gjm RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks |
High EPSS 0.29% |
<= 0.0.2 | No fix yet |
| GHSA-mx42-j6wv-px98 RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration |
Medium EPSS 0.20% |
<= 0.0.2 | No fix yet |
| GHSA-v9fg-3cr2-277j Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover |
Medium EPSS 5.05% |
< 1.0.0-alpha.83 | 1.0.0-alpha.83 |
| GHSA-w5fh-f8xh-5x3p RustFS: Missing Post Policy Validation leads to Arbitrary Object Write |
Critical EPSS 0.37% |
>= 1.0.0-alpha.56, < 1.0.0-alpha.83 | 1.0.0-alpha.83 |
| GHSA-r54g-49rx-98cr RustFS Logs Sensitive Credentials in Plaintext |
High EPSS 0.29% |
>= 1.0.0-alpha.13, < 1.0.0-alpha.82 | 1.0.0-alpha.82 |
| GHSA-fc6g-2gcp-2qrq RustFS has SourceIp bypass via spoofed X-Forwarded-For/Real-IP headers |
High EPSS 0.25% |
< 1.0.0-alpha.78 | 1.0.0-alpha.78 |
| GHSA-333v-68xh-8mmq RustFS's RPC signature verification logs shared secret |
High EPSS 0.52% |
>= 1.0.0-alpha.1, < 1.0.0-alpha.80 | 1.0.0-alpha.80 |
| GHSA-xgr5-qc6w-vcg9 RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting |
Critical EPSS 0.42% |
>= 1.0.0-alpha.13, < 1.0.0-alpha.79 | 1.0.0-alpha.79 |
| GHSA-vcwh-pff9-64cc RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation |
High EPSS 0.43% |
< 1.0.0-alpha.79 | 1.0.0-alpha.79 |
| GHSA-gw2x-q739-qhcr RustFS gRPC GetMetrics deserialization panic enables remote DoS |
Medium EPSS 0.34% |
>= 1.0.0-alpha.13, < 1.0.0-alpha.78 | 1.0.0-alpha.78 |
| GHSA-pq29-69jg-9mxc RustFS Path Traversal Vulnerability |
Critical EPSS 7.26% |
>= 1.0.0-alpha.13, < 1.0.0-alpha.79 | 1.0.0-alpha.79 |
| GHSA-h956-rh7x-ppgj RustFS has a gRPC Hardcoded Token Authentication Bypass |
Critical EPSS 31.85% |
>= 1.0.0-alpha.13, < 1.0.0-alpha.78 | 1.0.0-alpha.78 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor