Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

reffers

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.7crates.ioPublished

    Data races in reffers

    CVE-2020-36203 · GHSA-39xg-8p43-h76x

    Affected
    • crates.io reffers < 0.6.1
    Fixed in
    0.6.1· Vendor fix available
    Issue
    ARefss<'a, V is a type that is assumed to contain objects that are Send + Sync. In the affected versions of this crate, Send/Sync traits are unconditionally implemented for ARefss<'a, V. By using the ARefss::map() API, we can insert a !Send or !Sync object into ARefss<'a, V. After that, it is possible to create a data race to the inner object of ARefss<'a, V, which can lead to undefined behavior & memory corruption. The flaw was corrected in commit 6dd7ca0 by adding trait bound V: Send + Sync to ARefss::map() API.

    Recommended action: Upgrade to 0.6.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →