Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS00OG02LXdtNXAtcnI2aM4AA3Hq

Insufficient covariance check makes self_cell unsound

All public versions prior to 1.02 used an insufficient check to ensure that users correctly marked the dependent type as either covariant or not_covariant. This allowed users to mark a dependent as covariant even though its type was not covariant but invariant, for certain invariant types involving trait object lifetimes. One example for such a dependent type is type Dependent<'a> = RefCell<Box<dyn fmt::Display + 'a>>. Such a type allowed unsound usage in purely safe user code that leads to undefined behavior. The patched versions now produce a compile time error if such a type is marked as covariant.

Permalink: https://github.com/advisories/GHSA-48m6-wm5p-rr6h
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00OG02LXdtNXAtcnI2aM4AA3Hq
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 14 days ago
Updated: 14 days ago

Identifiers: GHSA-48m6-wm5p-rr6h
References:

• https://github.com/Voultapher/self_cell/issues/49
• https://rustsec.org/advisories/RUSTSEC-2023-0070.html
• https://github.com/advisories/GHSA-48m6-wm5p-rr6h

Affected Packages