To add an advisory to the RustSec database, open a Pull Request against this repository containing the new advisory:
- Create a file named
crates/<yourcratename>subdirectory of this repository (you may need to create it if it doesn't exist)
- Copy and paste the TOML advisory template from the README.md file in this repo. Delete the comments and additional whitespace, and fill it out with the details of the advisory.
- Open a Pull Request. After being reviewed your advisory will be assigned
RUSTSEC-*advisory identifier and be published to the database.
- (Optional, but recommended) Request a CVE for your vulnerability: https://iwantacve.org/
RustSec is a database of security vulnerabilities. The following are examples of qualifying vulnerabilities:
- Code Execution (i.e. RCE)
- Memory Corruption
- Privilege Escalation (either at OS level or inside of an app/library)
- File Disclosure / Directory Traversal
- Web Security (e.g. XSS, CSRF)
- Format Injection, e.g. shell escaping, SQL injection (and also XSS)
- Cryptography Failure (e.g. confidentiality breakage, integrity breakage, key leakage)
- Covert Channels (e.g. Spectre, Meltdown)
- Panics in code advertised as "panic-free" (particularly if useful for network DoS attacks)
When in doubt, please open a PR.
Q: Do I need to be owner of a crate to file an advisory?
A: No, anyone can file an advisory against any crate. The legitimacy of vulnerabilities will be determined prior to merging. If a vulnerability turns out to be fake it will be removed from the database.
Q: Can I file an advisory without creating a pull request?
Q: Does this project have a GPG key or other means of handling embargoed vulnerabilities?
A: We do not presently handle embargoed vulnerabilities. Please ensure embargoes have been lifted and details have been disclosed to the public prior to filing them against RustSec.