Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

zerocopy

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Unratedcrates.ioPublished

    Zerocopy: Some Ref methods are unsound with some type parameters

    GHSA-rjhf-4mh8-9xjq

    Affected
    • crates.io zerocopy >= 0.2.2, < 0.2.9; >= 0.3.0, < 0.3.2; >= 0.4.0, < 0.4.1; >= 0.5.0, < 0.5.2; >= 0.6.0, < 0.6.6; >= 0.7.0, < 0.7.31
    Fixed in
    0.7.310.2.90.5.20.3.20.6.60.4.1· Vendor fix available
    Issue
    The Ref methods intoref, intomut, intoslice, and intoslicemut are unsound and may allow safe code to exhibit undefined behavior when used with Ref<B, T where B is cell::Ref or cell::RefMut. Note that these methods remain sound when used with B types other than cell::Ref or cell::RefMut. See https://github.com/google/zerocopy/issues/716 for a more in-depth analysis. The current plan is to yank the affected versions soon. See https://github.com/google/zerocopy/issues/679 for more detail.

    Recommended action: Upgrade to 0.7.31, 0.6.6, 0.5.2 or 3 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Unratedcrates.ioPublished

    Ref methods into_ref, into_mut, into_slice, and into_slice_mut are unsound when used with cell::Ref or cell::RefMut

    GHSA-3mv5-343c-w2qg

    Affected
    • crates.io zerocopy >= 0.2.2, < 0.2.9; >= 0.3.0, < 0.3.2; >= 0.4.0, <= 0.4.0; >= 0.5.0, < 0.5.2; >= 0.6.0, < 0.6.6; >= 0.7.0, < 0.7.31
    Fixed in
    0.7.310.2.90.5.20.3.20.6.60.4.1· Vendor fix available
    Issue
    This advisory is also published as RUSTSEC-2023-0074. The Ref methods intoref, intomut, intoslice, and intoslicemut are unsound and may allow safe code to exhibit undefined behavior when used with Ref<B, T where B is cell::Ref or cell::RefMut. Note that these methods remain sound when used with B types other than cell::Ref or cell::RefMut. See https://github.com/google/zerocopy/issues/716 for a more in-depth analysis. The current plan is to yank the affected versions soon. See https://github.com/google/zerocopy/issues/679 for more detail.

    Recommended action: Upgrade to 0.7.31, 0.6.6, 0.5.2 or 3 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →