VEXRustFS
RustFS
5 declaraciones, emitidas el .Cada una es un hallazgo del escáner que no es explotable en esta imagen, y el motivo.
@id https://quench-works.com/vex/rustfs/2026-11-01
CVE-2026-116794
no afectado · componente ausente- russh 0.64.1
russh 0.64.1 (1.0.4) is listed only because the image ships the tag Cargo.lock at /usr/share/doc/rustfs/Cargo.lock (the prebuilt binary has no cargo-auditable section); the crate is not compiled into /usr/bin/rustfs. russh is optional in the rustfs-protocols crate and enabled only by the sftp feature (tag 1.0.4 commit 46337942d55f3a8e6a97b147ca98d9ea8115555d: crates/protocols/Cargo.toml:179 russh = { workspace = true, optional = true }, crates/protocols/Cargo.toml:109 sftp = [dep:russh, ...]; rustfs/Cargo.toml:60 default = [ftps, webdav, gcs], rustfs/Cargo.toml:66 the only route to rustfs-protocols/sftp). The other russh user, e2e_test, is a test crate outside the release build. Verified 2026-11-01: grep -aoE over the sha256-pinned musl binaries found 383 (1.0.4 x86_64), 379 (1.0.4 aarch64) registry/src crate-version paths and 0 matching russh or pageant, so the russh SSH agent server confirm-constraint handling code is not present. The recipe fails the build if any russh crate path appears in the binary or if the binary stops carrying crate paths.
CVE-2026-116696
no afectado · componente ausente- russh 0.64.1
russh 0.64.1 (1.0.4) is listed only because the image ships the tag Cargo.lock at /usr/share/doc/rustfs/Cargo.lock (the prebuilt binary has no cargo-auditable section); the crate is not compiled into /usr/bin/rustfs. russh is optional in the rustfs-protocols crate and enabled only by the sftp feature (tag 1.0.4 commit 46337942d55f3a8e6a97b147ca98d9ea8115555d: crates/protocols/Cargo.toml:179 russh = { workspace = true, optional = true }, crates/protocols/Cargo.toml:109 sftp = [dep:russh, ...]; rustfs/Cargo.toml:60 default = [ftps, webdav, gcs], rustfs/Cargo.toml:66 the only route to rustfs-protocols/sftp). The other russh user, e2e_test, is a test crate outside the release build. Verified 2026-11-01: grep -aoE over the sha256-pinned musl binaries found 383 (1.0.4 x86_64), 379 (1.0.4 aarch64) registry/src crate-version paths and 0 matching russh or pageant, so the russh SSH agent server constraint parsing code is not present. The recipe fails the build if any russh crate path appears in the binary or if the binary stops carrying crate paths.
CVE-2026-116775
no afectado · componente ausente- pageant 0.2.4
pageant is in the shipped tag Cargo.lock only as a dependency of russh (Cargo.lock 1.0.4: russh 0.64.1 -> pageant; no other package depends on it), and russh is not compiled into /usr/bin/rustfs. russh (the only route to pageant) is listed only because the image ships the tag Cargo.lock at /usr/share/doc/rustfs/Cargo.lock (the prebuilt binary has no cargo-auditable section); the crate is not compiled into /usr/bin/rustfs. russh is optional in the rustfs-protocols crate and enabled only by the sftp feature (tag 1.0.4 commit 46337942d55f3a8e6a97b147ca98d9ea8115555d: crates/protocols/Cargo.toml:179 russh = { workspace = true, optional = true }, crates/protocols/Cargo.toml:109 sftp = [dep:russh, ...]; rustfs/Cargo.toml:60 default = [ftps, webdav, gcs], rustfs/Cargo.toml:66 the only route to rustfs-protocols/sftp). The other russh user, e2e_test, is a test crate outside the release build. Verified 2026-11-01: grep -aoE over the sha256-pinned musl binaries found 383 (1.0.4 x86_64), 379 (1.0.4 aarch64) registry/src crate-version paths and 0 matching russh or pageant, so the pageant PageantStream frame buffering code is not present. The recipe fails the build if any russh crate path appears in the binary or if the binary stops carrying crate paths.
CVE-2026-116773
no afectado · componente ausente- russh 0.64.1
russh 0.64.1 (1.0.4) is listed only because the image ships the tag Cargo.lock at /usr/share/doc/rustfs/Cargo.lock (the prebuilt binary has no cargo-auditable section); the crate is not compiled into /usr/bin/rustfs. russh is optional in the rustfs-protocols crate and enabled only by the sftp feature (tag 1.0.4 commit 46337942d55f3a8e6a97b147ca98d9ea8115555d: crates/protocols/Cargo.toml:179 russh = { workspace = true, optional = true }, crates/protocols/Cargo.toml:109 sftp = [dep:russh, ...]; rustfs/Cargo.toml:60 default = [ftps, webdav, gcs], rustfs/Cargo.toml:66 the only route to rustfs-protocols/sftp). The other russh user, e2e_test, is a test crate outside the release build. Verified 2026-11-01: grep -aoE over the sha256-pinned musl binaries found 383 (1.0.4 x86_64), 379 (1.0.4 aarch64) registry/src crate-version paths and 0 matching russh or pageant, so the russh extension-handling allocation code is not present. The recipe fails the build if any russh crate path appears in the binary or if the binary stops carrying crate paths.
CVE-2026-116774
no afectado · componente ausente- russh 0.64.1
russh 0.64.1 (1.0.4) is listed only because the image ships the tag Cargo.lock at /usr/share/doc/rustfs/Cargo.lock (the prebuilt binary has no cargo-auditable section); the crate is not compiled into /usr/bin/rustfs. russh is optional in the rustfs-protocols crate and enabled only by the sftp feature (tag 1.0.4 commit 46337942d55f3a8e6a97b147ca98d9ea8115555d: crates/protocols/Cargo.toml:179 russh = { workspace = true, optional = true }, crates/protocols/Cargo.toml:109 sftp = [dep:russh, ...]; rustfs/Cargo.toml:60 default = [ftps, webdav, gcs], rustfs/Cargo.toml:66 the only route to rustfs-protocols/sftp). The other russh user, e2e_test, is a test crate outside the release build. Verified 2026-11-01: grep -aoE over the sha256-pinned musl binaries found 383 (1.0.4 x86_64), 379 (1.0.4 aarch64) registry/src crate-version paths and 0 matching russh or pageant, so the russh channel maximum-packet-size handling code is not present. The recipe fails the build if any russh crate path appears in the binary or if the binary stops carrying crate paths.