Mmastrac

**Name of the Vulnerable Software and Affected Versions** rust-openssl versions prior to 0.10.70 **Description** The issue arises when `ssl::select next proto` returns a slice pointing into the `server` argument's buffer but with a lifetime bound to the `client` argument. If the `server` buffer's lifetime is shorter than the `client` buffer's, this can cause a use after free, potentially leading to the server crashing or returning arbitrary memory contents to the client. The function `ssl::select next proto` is typically used in the callback passed to `SslContextBuilder::set alpn select callback`. Code is only affected if the `server` buffer is constructed within the callback. **Recommendations** To resolve the issue, update to version 0.10.70 or later of the `openssl` crate, which fixes the signature of `ssl::select next proto` to properly constrain the output buffer's lifetime to that of both input buffers. For versions prior to 0.10.70, ensure that the `server` buffer outlives the handshake or has a static lifetime to avoid the use after free issue.

**Name of the Vulnerable Software and Affected Versions** Deno versions prior to 1.43 **Description** The Deno sandbox may be unexpectedly weakened by allowing file read/write access to privileged files in various locations on Unix and Windows platforms. For example, reading `/proc/self/environ` may provide access equivalent to `--allow-env`, and writing `/proc/self/mem` may provide access equivalent to `--allow-all`. Users who grant read and write access to the entire filesystem may not realize that these accesses to these files may have additional, unintended consequences. **Recommendations** For Deno versions prior to 1.43, consider adding explicit deny flags to restrict access to sensitive files, such as `--deny-read=/dev`, `--deny-read=/sys`, `--deny-read=/proc`, `--deny-read=/etc`, `--deny-write=/dev`, `--deny-write=/sys`, `--deny-write=/proc`, and `--deny-write=/etc`. Note that symlinks in allowed locations may defeat this protection in earlier versions of Deno. For Deno 1.43 and above, ensure explicit `--allow-all` access is required to read or write `/etc`, `/dev` on Unix platforms, as well as `/proc` and `/sys` on Linux platforms, and any path starting with `` on Windows.

**Name of the Vulnerable Software and Affected Versions** Deno versions 1.35.1 through 1.36.2 **Description** A vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams sourced from sockets or files. This issue arises from the re-use of a global buffer (`BUF`) in `stream wrap.ts` used as a performance optimization to limit allocations during these asynchronous read operations. The vulnerability can lead to data intended for one session being received by another session, potentially resulting in data corruption and unexpected behavior. This affects all users of Deno that use the node.js compatibility layer for network communication or other streams, including packages that may require node.js libraries indirectly. **Recommendations** For Deno versions 1.35.1 through 1.36.2, update to version 1.36.3 or later to resolve the issue. As a temporary workaround, consider disabling the use of Node.js streams sourced from sockets or files until a patch is applied. Restrict access to the `stream wrap.ts` module to minimize the risk of exploitation. Avoid using the `net.Stream` API connected to remote servers such as databases or key/value stores until the issue is resolved.