Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1tMzI1LXJ4anYtcHdwaM4AArsq

Deserialization functions pass uninitialized memory to user-provided Read

Affected versions of this crate passed an uninitialized buffer to a
user-provided Read instance in:

• deserialize_binary
• deserialize_string
• deserialize_extension_others
• deserialize_string_primitive

This can result in safe Read implementations reading from the uninitialized
buffer leading to undefined behavior.

Permalink: https://github.com/advisories/GHSA-m325-rxjv-pwph
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tMzI1LXJ4anYtcHdwaM4AArsq
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: 11 months ago

Identifiers: GHSA-m325-rxjv-pwph
References:

• https://github.com/otake84/messagepack-rs/issues/2
• https://rustsec.org/advisories/RUSTSEC-2021-0092.html
• https://github.com/advisories/GHSA-m325-rxjv-pwph

Repository: https://github.com/otake84/messagepack-rs
Blast Radius: 0.0

Affected Packages