Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1xajY5LWM4OXYtandxMs4AArq0

Reading on uninitialized memory may cause UB ( `util::read_spv()` )

Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation.

Arbitrary Read implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer.
Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.

Permalink: https://github.com/advisories/GHSA-qj69-c89v-jwq2
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xajY5LWM4OXYtandxMs4AArq0
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: over 1 year ago


Identifiers: GHSA-qj69-c89v-jwq2
References: Repository: https://github.com/MaikKlein/ash
Blast Radius: 0.0

Affected Packages

cargo:ash
Dependent packages: 95
Dependent repositories: 4,568
Downloads: 5,464,259 total
Affected Version Ranges: < 0.33.1
Fixed in: 0.33.1
All affected versions: 0.1.0, 0.2.0, 0.3.0, 0.3.1, 0.9.0, 0.10.0, 0.11.0, 0.12.0, 0.13.0, 0.14.0, 0.14.1, 0.14.2, 0.14.3, 0.15.3, 0.15.4, 0.15.5, 0.15.6, 0.15.7, 0.15.8, 0.16.0, 0.17.0, 0.17.1, 0.18.0, 0.18.1, 0.18.2, 0.18.3, 0.18.4, 0.18.5, 0.18.6, 0.19.0, 0.19.1, 0.20.0, 0.20.1, 0.20.2, 0.20.3, 0.21.0, 0.21.1, 0.22.0, 0.22.1, 0.22.2, 0.23.0, 0.24.0, 0.24.1, 0.24.2, 0.24.3, 0.24.4, 0.25.0, 0.26.0, 0.26.1, 0.26.2, 0.27.0, 0.27.1, 0.28.0, 0.29.0, 0.30.0, 0.31.0, 0.32.0, 0.32.1, 0.33.0
All unaffected versions: 0.33.1, 0.33.2, 0.33.3, 0.34.0, 0.35.0, 0.35.1, 0.35.2, 0.36.0, 0.37.0, 0.37.1, 0.37.2, 0.37.3, 0.38.0