Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXhwNnYtcXg2NS00cHA3

Data races in gfwx

In the affected versions of this crate, ImageChunkMut<'_, T> unconditionally implements Send and Sync, allowing to create data races.

This can result in a memory corruption or undefined behavior when non thread-safe types are moved and referenced across thread boundaries.

The flaw was corrected in commit e7fb2f5 by adding T: Send bound to the Send impl and adding T: Sync bound to the Sync impl.

Permalink: https://github.com/advisories/GHSA-xp6v-qx65-4pp7
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXhwNnYtcXg2NS00cHA3
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: 11 months ago

CVSS Score: 7.0
CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-xp6v-qx65-4pp7, CVE-2020-36211
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-36211
• https://github.com/Devolutions/gfwx-rs/issues/7
• https://rustsec.org/advisories/RUSTSEC-2020-0104.html
• https://github.com/advisories/GHSA-xp6v-qx65-4pp7

Repository: https://github.com/Devolutions/gfwx-rs
Blast Radius: 1.0

Affected Packages