Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS0zamNoLTlxZ3AtNDg0NM4AArrG

Generated code can read and write out of bounds in safe code

Code generated by flatbuffers' compiler is unsafe but not marked as such. See https://github.com/google/flatbuffers/issues/6627 for details.

All users that use generated code by flatbuffers compiler are recommended to:

not expose flatbuffer generated code as part of their public APIs
audit their code and look for any usage of follow, push, or any method that uses them (e.g. self_follow).
Carefuly go through the crates' documentation to understand which "safe" APIs are not intended to be used.

Permalink: https://github.com/advisories/GHSA-3jch-9qgp-4844
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zamNoLTlxZ3AtNDg0NM4AArrG
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 1 year ago
Updated: 9 months ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-3jch-9qgp-4844
References:

Versions: < 22.9.29
Fixed in: 22.9.29