In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.

fedora FEDORA-2025-7227c166f0: maturin-1.8.6-1.fc42

fedora FEDORA-2025-04894ce9bd: ruff-0.11.5-2.fc42 rust-hashlink-0.10.0-1.fc42 rust-rusqlite-0.31.0-6.fc42

The remote Fedora 42 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-4fc3431dab advisory.

    This release includes improvements and fixes, and updates crossbeam-channel dependency to address     CVE-2025-4574

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-c53905e83d advisory.

    This release includes improvements and fixes, and updates crossbeam-channel dependency to address     CVE-2025-4574

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-3b4c75f23c advisory.

    Automatic update for rust-git-interactive-rebase-tool-2.4.1-9.fc43.

    ##### **Changelog**

    ```
    * Sun Jun  8 2025 Benjamin Gilbert <bgilbert@backtick.net> - 2.4.1-9
    - Rebuild for CVE-2024-12224, CVE-2025-4574 (rhbz#2370599, rhbz#2366573)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-57f7169b9d advisory.

    This release includes improvements and fixes, and updates crossbeam-channel dependency to address     CVE-2025-4574

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-575023fff7 advisory.

    Security update for CVE-2025-4574, GHSA-pg9f-39pc-qf8g: by rebuilding `ruff`, we ensure that it uses     version 0.5.15 of the `crossbeam-channel` crate library.

    -----

    ## `rust-hashlink` 0.10.0

    - API incompatible change: upgrade `hashbrown` to 0.15
    - API incompatible change: we now wrap `DefaultHashBuilder` and `DefaultHasher`       from `hashbrown` so that in the future upgrading `hashbrown` is not an API       incompatible change

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-fb7b9c7c48 advisory.

    Update to version 1.8.6.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-e5d435516f advisory.

    Security fix for CVE-2025-4574 (fix RHBZ#2366569)

    The package was rebuilt with rust-crossbeam-channel 0.5.15.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01591-1 advisory.

    - CVE-2025-3416: openssl: use-after-free in `Md::fetch` and `Cipher::fetch` when `Some(...)` value passed     as       `properties` argument to either function (bsc#1242631).
    - CVE-2025-4574: crossbeam-channel: double-free leading to possible memory corruption in `Channel::drop`     when dropping       a channel (bsc#1243177).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
238450	Fedora 42 : libkrun / rust-kbs-types / rust-sev / rust-sevctl (2025-4fc3431dab)	Nessus	Fedora Local Security Checks	medium
238447	Fedora 41 : libkrun / rust-kbs-types / rust-sev / rust-sevctl (2025-c53905e83d)	Nessus	Fedora Local Security Checks	medium
237942	Fedora 43 : rust-git-interactive-rebase-tool (2025-3b4c75f23c)	Nessus	Fedora Local Security Checks	medium
237873	Fedora 43 : libkrun / rust-kbs-types / rust-sev / rust-sevctl (2025-57f7169b9d)	Nessus	Fedora Local Security Checks	medium
237560	Fedora 41 : ruff / rust-hashlink / rust-rusqlite (2025-575023fff7)	Nessus	Fedora Local Security Checks	medium
237526	Fedora 41 : maturin (2025-fb7b9c7c48)	Nessus	Fedora Local Security Checks	medium
237169	Fedora 41 : python-watchfiles (2025-e5d435516f)	Nessus	Fedora Local Security Checks	medium
237080	openSUSE 15 Security Update : python-maturin (SUSE-SU-2025:01591-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2025-4574

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium

medium

medium

medium