Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1qZjVoLWNmOTUtdzc1Oc4AArsy

Optional `Deserialize` implementations lacking validation

When activating the non-default feature serialize, most structs implement
serde::Deserialize without sufficient validation. This allows breaking
invariants in safe code, leading to:

• Undefined behavior in as_string() methods (which use
  std::str::from_utf8_unchecked() internally).
• Panics due to failed assertions.

See https://github.com/gz/rust-cpuid/issues/43.

Permalink: https://github.com/advisories/GHSA-jf5h-cf95-w759
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qZjVoLWNmOTUtdzc1Oc4AArsy
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 10 months ago

Identifiers: GHSA-jf5h-cf95-w759
References:

• https://github.com/gz/rust-cpuid/issues/43
• https://rustsec.org/advisories/RUSTSEC-2021-0089.html
• https://github.com/advisories/GHSA-jf5h-cf95-w759

Repository: https://github.com/gz/rust-cpuid
Blast Radius: 0.0

Affected Packages