Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW14djYtcTk4eC1oOTU4

Data races in model

Shared data structure in model crate implements Send and Sync traits regardless of the inner type.
This allows safe Rust code to trigger a data race, which is undefined behavior in Rust.

Users are advised to treat Shared as an unsafe type.
It should not be used outside of the testing context,
and care must be taken so that the testing code does not have a data race
besides a race condition that is expected to be caught by the test.

Permalink: https://github.com/advisories/GHSA-mxv6-q98x-h958
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW14djYtcTk4eC1oOTU4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: about 1 year ago

CVSS Score: 8.1
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-mxv6-q98x-h958, CVE-2020-36460
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-36460
• https://github.com/spacejam/model/issues/3
• https://rustsec.org/advisories/RUSTSEC-2020-0140.html
• https://github.com/advisories/GHSA-mxv6-q98x-h958

Repository: https://github.com/spacejam/model
Blast Radius: 9.0

Affected Packages