{"id":"CVE-2024-58266","aliases":["AZL-66008","AZL-66017","AZL-66029","AZL-66035","DEBIAN-CVE-2024-58266","EUVD-2024-54826","GHSA-r7qv-8r2h-pg27","RUSTSEC-2024-0006","SUSE-SU-2025:03077-1","SUSE-SU-2025:03092-1","SUSE-SU-2025:20717-1","SUSE-SU-2025:20858-1","UBUNTU-CVE-2024-58266","openSUSE-SU-2025:15433-1"],"status":"published","title":"Multiple issues involving quote API in shlex","description":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","severity":{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00778,"percentile":0.56291,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116"],"published":"2024-01-21T12:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"crates.io","package":"shlex","fixed_in":["1.3.0"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"rust","fixed_in":["1.75.0-30","1.86.0-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rust-shlex","fixed_in":["1.3.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rust-shlex","fixed_in":["1.3.0-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"rav1e","fixed_in":["0.6.6-150600.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"rav1e","fixed_in":["0.6.6-150600.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"rav1e","fixed_in":["0.6.6-150600.3.6.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"shlex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"kata-containers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.2.0.azl2-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.72.0-14"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.0-30"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.85.0"},{"fixed":"1.86.0-3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rust-shlex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-1","1.2.0-1","1.3.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"rust-shlex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rust-shlex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"shlex","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"shlex","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"1.3.0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"rav1e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.6-150600.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"rav1e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.6-150600.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"rav1e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.6-150600.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8+12-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8+12-slfo.1.1_1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rust-shlex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rust-shlex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-shlex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-1","1.2.0-1","1.3.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-shlex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-shlex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-shlex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"framework-inputmodule-control","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-3.1"}]}],"bundled":2}],"products":[{"vendor":"comex","product":"shlex"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0006.html","tags":["Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/comex/rust-shlex/security/advisories/GHSA-r7qv-8r2h-pg27","tags":["Vendor Advisory","advisory","web","report"]},{"url":"https://crates.io/crates/shlex","tags":["Product","web","package","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58266","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-r7qv-8r2h-pg27"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58266.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-58266","tags":["advisory"]},{"url":"https://github.com/comex/rust-shlex","tags":["package"]},{"url":"https://github.com/comex/rust-shlex/commit/4a0724b0b62ef715467875b040a890ce75a8a829","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503077-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230028","tags":["report"]},{"url":"https://bugzilla.suse.com/1247207","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-58266","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503092-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520717-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1242623","tags":["report"]},{"url":"https://bugzilla.suse.com/1247193","tags":["report"]},{"url":"https://bugzilla.suse.com/1248006","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55159","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520858-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1229952","tags":["report"]},{"url":"https://bugzilla.suse.com/1230029","tags":["report"]},{"url":"https://bugzilla.suse.com/1243861","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43806","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-58266","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-58266","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53156","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-58266","description":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","status":"published","published":"2025-07-27T00:00:00Z","modified":"2025-07-28T15:03:56.004Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:34:08.843708Z"}],"euvd":[{"id":"EUVD-2024-54826","description":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","status":"published","published":"2025-07-27T00:00:00Z","modified":"2025-07-28T15:03:56Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T20:32:03.907132Z"}],"ghsa":[{"id":"GHSA-r7qv-8r2h-pg27","title":"Multiple issues involving quote API in shlex","description":"## Issue 1: Failure to quote characters\n\nAffected versions of this crate allowed the bytes `{` and `\\xa0` to appear unquoted and unescaped in command arguments.\n\nIf the output of `quote` or `join` is passed to a shell, then what should be a single command argument could be interpreted as multiple arguments.\n\nThis does not *directly* allow arbitrary command execution (you can't inject a command substitution or similar).  But depending on the command you're running, being able to inject multiple arguments where only one is expected could lead to undesired consequences, potentially including arbitrary command execution.\n\nThe flaw was corrected in version 1.2.1 by escaping additional characters. Updating to 1.3.0 is recommended, but 1.2.1 offers a more minimal fix if desired.\n\nWorkaround: Check for the bytes `{` and `\\xa0` in `quote`/`join` input or output.\n\n(Note: `{` is problematic because it is used for glob expansion.  `\\xa0` is problematic because it's treated as a word separator in [specific environments][solved-xa0].)\n\n## Issue 2: Dangerous API w.r.t. nul bytes\n\nVersion 1.3.0 deprecates the `quote` and `join` APIs in favor of `try_quote` and `try_join`, which behave the same except that they have `Result` return type, returning `Err` if the input contains nul bytes.\n\nStrings containing nul bytes generally cannot be used in Unix command arguments or environment variables, and most shells cannot handle nul bytes even internally.  If you try to pass one anyway, then the results might be security-sensitive in uncommon scenarios.  [More details here.][nul-bytes]\n\nDue to the low severity, the behavior of the original `quote` and `join` APIs has not changed; they continue to allow nuls.\n\nWorkaround: Manually check for nul bytes in `quote`/`join` input or output.\n\n## Issue 3: Lack of documentation for interactive shell risks\n\nThe `quote` family of functions does not and cannot escape control characters. With non-interactive shells this is perfectly safe, as control characters have no special effect.  But if you writing directly to the standard input of an interactive shell (or through a pty), then control characters [can cause misbehavior including arbitrary command injection.][control-characters]\n\nThis is essentially unfixable, and has not been patched.  But as of version 1.3.0, documentation has been added.\n\nFuture versions of `shlex` may add API variants that avoid the issue at the cost of reduced portability.\n\n[solved-xa0]: https://docs.rs/shlex/latest/shlex/quoting_warning/index.html#solved-xa0\n[nul-bytes]: https://docs.rs/shlex/latest/shlex/quoting_warning/index.html#nul-bytes\n[control-characters]: https://docs.rs/shlex/latest/shlex/quoting_warning/index.html#control-characters-interactive-contexts-only","status":"published","published":"2024-01-22T21:21:30Z","modified":"2025-07-28T15:58:55Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T14:38:51.864708Z"}],"nvd":[{"id":"CVE-2024-58266","description":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","status":"published","published":"2025-07-27T22:15:25.707Z","modified":"2026-06-17T08:14:44.607Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:10:47.073504Z"}],"osv":[{"id":"CVE-2024-58266","description":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","status":"published","published":"2025-07-27T00:00:00Z","modified":"2026-10-28T02:31:01.834374112Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:44:45.107804Z"},{"id":"DEBIAN-CVE-2024-58266","description":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","status":"published","published":"2025-07-27T22:15:25.707Z","modified":"2026-11-02T12:03:12.187261724Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:44.747956Z"},{"id":"GHSA-r7qv-8r2h-pg27","title":"Multiple issues involving quote API in shlex","description":"## Issue 1: Failure to quote characters\n\nAffected versions of this crate allowed the bytes `{` and `\\xa0` to appear unquoted and unescaped in command arguments.\n\nIf the output of `quote` or `join` is passed to a shell, then what should be a single command argument could be interpreted as multiple arguments.\n\nThis does not *directly* allow arbitrary command execution (you can't inject a command substitution or similar).  But depending on the command you're running, being able to inject multiple arguments where only one is expected could lead to undesired consequences, potentially including arbitrary command execution.\n\nThe flaw was corrected in version 1.2.1 by escaping additional characters. Updating to 1.3.0 is recommended, but 1.2.1 offers a more minimal fix if desired.\n\nWorkaround: Check for the bytes `{` and `\\xa0` in `quote`/`join` input or output.\n\n(Note: `{` is problematic because it is used for glob expansion.  `\\xa0` is problematic because it's treated as a word separator in [specific environments][solved-xa0].)\n\n## Issue 2: Dangerous API w.r.t. nul bytes\n\nVersion 1.3.0 deprecates the `quote` and `join` APIs in favor of `try_quote` and `try_join`, which behave the same except that they have `Result` return type, returning `Err` if the input contains nul bytes.\n\nStrings containing nul bytes generally cannot be used in Unix command arguments or environment variables, and most shells cannot handle nul bytes even internally.  If you try to pass one anyway, then the results might be security-sensitive in uncommon scenarios.  [More details here.][nul-bytes]\n\nDue to the low severity, the behavior of the original `quote` and `join` APIs has not changed; they continue to allow nuls.\n\nWorkaround: Manually check for nul bytes in `quote`/`join` input or output.\n\n## Issue 3: Lack of documentation for interactive shell risks\n\nThe `quote` family of functions does not and cannot escape control characters. With non-interactive shells this is perfectly safe, as control characters have no special effect.  But if you writing directly to the standard input of an interactive shell (or through a pty), then control characters [can cause misbehavior including arbitrary command injection.][control-characters]\n\nThis is essentially unfixable, and has not been patched.  But as of version 1.3.0, documentation has been added.\n\nFuture versions of `shlex` may add API variants that avoid the issue at the cost of reduced portability.\n\n[solved-xa0]: https://docs.rs/shlex/latest/shlex/quoting_warning/index.html#solved-xa0\n[nul-bytes]: https://docs.rs/shlex/latest/shlex/quoting_warning/index.html#nul-bytes\n[control-characters]: https://docs.rs/shlex/latest/shlex/quoting_warning/index.html#control-characters-interactive-contexts-only","status":"published","published":"2024-01-22T21:21:30Z","modified":"2025-07-28T16:42:04.422423Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"UBUNTU-CVE-2024-58266","description":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","status":"published","published":"2025-07-27T22:15:00Z","modified":"2026-10-17T12:56:58.845075573Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"AZL-66008","title":"CVE-2024-58266 affecting package kata-containers 3.2.0.azl2-7","description":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","status":"published","published":"2025-07-27T22:15:25Z","modified":"2026-04-21T04:37:45.103987Z","updated_at":"2026-11-02T15:28:08.354547Z"},{"id":"AZL-66017","title":"CVE-2024-58266 affecting package rust 1.72.0-14","description":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","status":"published","published":"2025-07-27T22:15:25Z","modified":"2026-04-21T04:37:45.113004Z","updated_at":"2026-11-02T15:28:08.354547Z"},{"id":"AZL-66029","title":"CVE-2024-58266 affecting package rust for versions less than 1.75.0-30","description":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","status":"published","published":"2025-07-27T22:15:25Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:23.841127Z"},{"id":"AZL-66035","title":"CVE-2024-58266 affecting package rust for versions less than 1.86.0-3","description":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","status":"published","published":"2025-07-27T22:15:25Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:23.841127Z"},{"id":"openSUSE-SU-2025:15433-1","title":"framework-inputmodule-control-0.2.0-3.1 on GA media","description":"These are all security issues fixed in the framework-inputmodule-control-0.2.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-12T00:00:00Z","modified":"2026-03-23T04:53:46.620849Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"RUSTSEC-2024-0006","title":"Multiple issues involving quote API","description":"## Issue 1: Failure to quote characters\n\nAffected versions of this crate allowed the bytes `{` and `\\xa0` to appear\nunquoted and unescaped in command arguments.\n\nIf the output of `quote` or `join` is passed to a shell, then what should be a\nsingle command argument could be interpreted as multiple arguments.\n\nThis does not *directly* allow arbitrary command execution (you can't inject a\ncommand substitution or similar).  But depending on the command you're running,\nbeing able to inject multiple arguments where only one is expected could lead\nto undesired consequences, potentially including arbitrary command execution.\n\nThe flaw was corrected in version 1.2.1 by escaping additional characters.\nUpdating to 1.3.0 is recommended, but 1.2.1 offers a more minimal fix if\ndesired.\n\nWorkaround: Check for the bytes `{` and `\\xa0` in `quote`/`join` input or\noutput.\n\n(Note: `{` is problematic because it is used for glob expansion.  `\\xa0` is\nproblematic because it's treated as a word separator in [specific\nenvironments][solved-xa0].)\n\n## Issue 2: Dangerous API w.r.t. nul bytes\n\nVersion 1.3.0 deprecates the `quote` and `join` APIs in favor of `try_quote`\nand `try_join`, which behave the same except that they have `Result` return\ntype, returning `Err` if the input contains nul bytes.\n\nStrings containing nul bytes generally cannot be used in Unix command arguments\nor environment variables, and most shells cannot handle nul bytes even\ninternally.  If you try to pass one anyway, then the results might be\nsecurity-sensitive in uncommon scenarios.  [More details here.][nul-bytes]\n\nDue to the low severity, the behavior of the original `quote` and `join` APIs\nhas not changed; they continue to allow nuls.\n\nWorkaround: Manually check for nul bytes in `quote`/`join` input or output.\n\n## Issue 3: Lack of documentation for interactive shell risks\n\nThe `quote` family of functions does not and cannot escape control characters.\nWith non-interactive shells this is perfectly safe, as control characters have\nno special effect.  But if you writing directly to the standard input of an\ninteractive shell (or through a pty), then control characters [can cause\nmisbehavior including arbitrary command injection.][control-characters]\n\nThis is essentially unfixable, and has not been patched.  But as of version\n1.3.0, documentation has been added.\n\nFuture versions of `shlex` may add API variants that avoid the issue at the\ncost of reduced portability.\n\n[solved-xa0]: https://docs.rs/shlex/latest/shlex/quoting_warning/index.html#solved-xa0\n[nul-bytes]: https://docs.rs/shlex/latest/shlex/quoting_warning/index.html#nul-bytes\n[control-characters]: https://docs.rs/shlex/latest/shlex/quoting_warning/index.html#control-characters-interactive-contexts-only","status":"published","published":"2024-01-21T12:00:00Z","modified":"2026-10-12T18:00:05.115853645Z","updated_at":"2026-11-02T15:53:39.971022Z"},{"id":"SUSE-SU-2025:03077-1","title":"Security update for rav1e","description":"This update for rav1e fixes the following issues:\n\n- CVE-2024-58266: shlex: Fixed certain bytes allowed to appear unquoted and unescaped in command arguments (bsc#1247207)\n","status":"published","published":"2025-09-04T10:54:50Z","modified":"2026-03-23T04:47:57.961538Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03092-1","title":"Security update for rav1e","description":"This update for rav1e fixes the following issues:\n\n- Update crate shlex to 1.3.0:\n  * CVE-2024-58266: Fixed command injection (bsc#1247207)\n  * RUSTSEC-2024-0006: Fixed multiple issues involving quote API (bsc#1230028)\n","status":"published","published":"2025-09-05T17:20:45Z","modified":"2026-02-04T03:58:26.722314Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:20717-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\n- Update vendored crate slab to version 0.4.11\n  * CVE-2025-55159: Fixed incorrect bounds check in get_disjoint_mut function \n    leading to undefined behavior or potential crash due to out-of-bounds \n    access (bsc#1248006)\n\n- Update to version 0.2.8+12:\n  * build(deps): bump actions/checkout from 4 to 5\n  * build(deps): bump cfg-if from 1.0.0 to 1.0.1\n  * build(deps): bump openssl from 0.10.72 to 0.10.73\n  * build(deps): bump clap from 4.5.39 to 4.5.45\n  * build(deps): bump pest from 2.8.0 to 2.8.1\n  * Fix clippy warnings\n  * Use verifier-provided interval for continuous attestation timing\n  * Add meta object with seconds_to_next_attestation to evidence response\n  * Fix boot time retrieval\n  * Fix IMA log format (it must be ['text/plain']) (#1073)\n  * Remove unnecessary configuration fields\n  * cargo: Bump retry-policies to version 0.4.0\n\n- Update vendored crate shlex to version 1.3.0\n  * CVE-2024-58266: Fixed command injection (bsc#1247193) \n\n- Update to version 0.2.7+141:\n  * service: Use WantedBy=multi-user.target\n  * rpm: Add subpackage for push-attestation agent\n  * push-model: implement continuous attestation with configurable intervals\n  * Retry registration forever in the state machine\n  * Add Verifier URL to configuration\n  * Align exp.backoff to current configuration format\n  * Increase coverage of state machine (using Context)\n  * Increase coverage of struct_filler.rs\n  * Groom code (remove dead code)\n  * Fix exponential backoff (10secs, 4xx accepted)\n  * test: Add documentation test to tests/run.sh\n  * tpm: Avoid running code example during documentation tests\n  * state_machine: Always start the agent from the Unregistered state\n  * Add fixes for the URL construction\n  * Refactor evidences collection in push attestation agent\n  * push-model: refactor attestation logic into a state machine\n  * Fix body sending by allowing serializing strings (#1057)\n  * Log ResilientClient errors/response status codes (#1055)\n  * Add AK signing scheme and hash algorithm to negotiation\n  * tpm: Add method to extract signing scheme and hash algorithm from AK\n  * Allow custom content-type/accept headers\n  * Integrate exponential backoff to registration (#1052)\n  * keylime/structures: Rename ShaValues to PcrBanks\n  * Add resilient_client for exponential backoff (#1048)\n\n- Update vendored crate openssl 0.10.73:\n  * CVE-2025-3416: Fixed Use-After-Free in Md::fetch and Cipher::fetch (bsc#1242623) \n\n- Update to version 0.2.7+117:\n  * Increase coverage in evidence handling structure\n  * Add Capabilities Negotiations resp. missing fields\n  * Fix UEFI test to check file access in all cases\n  * context_info_handler: Do not assume /var/lib/keylime exists\n  * Fix clippy warnings about uninlined format arguments\n  * attestation: Allow unwrap() in tests\n  * Increase coverage (groom code, extend unit tests)\n  * Include IMA/UEFI logs in Evidence Handling request\n  * Include method to get all IMA entries as string\n  * Send correct list of pcr banks and sign algorithms\n  * Try to fix TPM tests related issues\n  * Define attestation perform asynchronous\n  * Perform attestation in push model agent binary\n  * Refactor code to use new attestation.rs\n  * Create attestation.rs for Attestation stuff\n  * Move ContextInfo management to its own handler\n  * Adjust context_info.rs after rebase\n  * Add attestation function to ContextInfo structure\n  * Add prohibited signing algorithms, avoid ecschnorr\n  * keylime/config: Use macro to implement PushModelConfigTrait\n  * Introduce keylime-macros and define_view_trait\n  * config: Remove KeylimeConfig structure\n  * config: Remove unnecessary options and lazy initialization\n  * Fix pcr_bank function to send all possible slots\n  * Send Content-Type:application/json on request (#1039)\n  * Send correct 'key_algorithm' in certification_keys (#1035)\n  * Push Model: Persist Attestation Key to file\n  * Add Keylime push model binary to root GNUmakefile\n  * Use singleton to avoid multiple Context allocation\n  * tests: Do not assume `/var/lib/keylime` exists (#1030)\n  * lib/cert: Fix race condition due to use of same file path\n  * payloads: Fix race condition in tests\n  * Add uefi_log_handler.rs to parse UEFI binary\n  * Use IMA log parser to send correct entry count\n  * Add IMA log parser\n  * build(deps): bump once_cell from 1.19.0 to 1.21.3\n  * lib/config/base.rs: Add more unit tests\n  * lib/permissions: Add unit tests\n  * keylime-agent: move JsonWrapper from common.rs to the library\n  * lib/agent_data: Move agent_data related tests from common\n  * common: Replace APIVersion with the library Version structure\n  * keylime_agent: Move secure_mount.rs to the library\n  * lib: Rename keylime_error.rs as error.rs\n  * config: Move config to keylime library\n  * config: Rename push_model_config to push_model\n  * lib: Move permissions.rs from keylime-agent to the lib\n  * Extract Capabilities Negotiation info from TPM (#1014)\n","status":"published","published":"2025-09-16T07:50:08Z","modified":"2026-03-23T04:50:57.095667Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20858-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\n- CVE-2025-55159: slab: incorrect bounds check in get_disjoint_mut function can lead to undefined behavior or potential crash due to out-of-bounds access (bsc#1248006)\n- CVE-2025-3416: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242623)\n- CVE-2024-58266: shlex: certain bytes allowed to appear unquoted and unescaped in command arguments (bsc#1247193)\n- CVE-2024-43806: rustix: rustix::fs::Dir iterator with the linux_raw backend can cause memory explosion (bsc#1229952)\n- CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243861)\n\n- RUSTSEC-2024-0006: Multiple issues involving quote API (bsc#1230029)\n","status":"published","published":"2025-10-14T13:18:43Z","modified":"2026-03-23T04:42:58.932899Z","updated_at":"2026-11-02T15:53:59.92114Z"}]}}