Hello and welcome to the Thursday, April 11th, 2004 edition of the Sands and at Storm Center's

Stormcast. My name is Johannes Ulrich and today I'm recording from London, England. Well, let's

today start with a critical update for the Windows version of the programming language Rust. This vulnerability

in the standard library has a perfect CSS score of 10, even though the risk, well, may or

may not a little bit more limited. It depends really on how you are using the affected API, and that's the command API.

Actually, an API that exists in pretty much any language and has had issues in pretty much any language.

The purpose of the command API is to execute a command via command.exe and securely escape any command parameters being passed in order to avoid OS command injection, a very common vulnerability, where you, for example, can use things like semicolons and dollar simples and the like in order to execute additional

commands by passing them as a command parameter. Before you say, isn't Rust supposed to be a

secure programming language? Yes, it is, but with specific issues around memory safety in mind,

other vulnerabilities will of course still occur in Rust, just like in any other language.

Now the tricky part about this particular vulnerability is that it really affects software created with Rust

much more than Rust itself. So having Rust installed on your system, for example, will not

really expose you to any particular risks in this case, but if you're running software

that uses the command API and was compiled using the old version of the standard library,

well, then that particular binary would expose you to this vulnerability.

And then as typical as part of Patch Tuesday, we also got updates from Adobe nine different

products received updates.

I'm not going over all the details here.

There are, for example, quite a few products that are affected by a single

out-of-bounds read vulnerability. CVS score only of 5.5. The one product that I want to focus on a little

bit is Adobe's Commerce product. Used to be known as Magento. Well, this product, two vulnerabilities for being addressed here.

One is an operator code execution, just says here, improper input validation, CVSS score of 9,

...