Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1qZjVoLWNmOTUtdzc1Oc4AArsy
Optional `Deserialize` implementations lacking validation
When activating the non-default feature serialize
, most structs implement
serde::Deserialize
without sufficient validation. This allows breaking
invariants in safe code, leading to:
- Undefined behavior in
as_string()
methods (which use
std::str::from_utf8_unchecked()
internally). - Panics due to failed assertions.
See https://github.com/gz/rust-cpuid/issues/43.
Permalink: https://github.com/advisories/GHSA-jf5h-cf95-w759JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qZjVoLWNmOTUtdzc1Oc4AArsy
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: over 1 year ago
Identifiers: GHSA-jf5h-cf95-w759
References:
- https://github.com/gz/rust-cpuid/issues/43
- https://rustsec.org/advisories/RUSTSEC-2021-0089.html
- https://github.com/advisories/GHSA-jf5h-cf95-w759
Blast Radius: 0.0
Affected Packages
cargo:raw-cpuid
Dependent packages: 59Dependent repositories: 2,650
Downloads: 34,602,090 total
Affected Version Ranges: >= 3.1.0, < 9.1.1
Fixed in: 9.1.1
All affected versions: 3.1.0, 4.0.0, 5.0.0, 6.0.0, 6.1.0, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 8.0.0, 8.1.0, 8.1.1, 8.1.2, 9.0.0, 9.0.1, 9.1.0
All unaffected versions: 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.1.0, 0.1.1, 0.2.0, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 2.0.0, 2.0.1, 2.0.2, 3.0.0, 9.1.1, 10.0.0, 10.1.0, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 11.0.0, 11.0.1, 11.0.2, 11.1.0, 11.2.0