GHSA-36xm-35qq-795w
Suggest an improvement- Source
- https://github.com/advisories/GHSA-36xm-35qq-795w
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-36xm-35qq-795w/GHSA-36xm-35qq-795w.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-36xm-35qq-795w
- Aliases
- Published
- 2023-09-11T20:43:41Z
- Modified
- 2024-02-10T16:26:47.997172Z
- Summary
- Inventory exposes reference to non-Sync data to an arbitrary thread
- Details
-
Affected versions do not enforce a
Syncbound on the type of caller-provided value held in the plugin registry. References to these values are made accessible to arbitrary threads other than the one that constructed them.A caller could use this flaw to submit thread-unsafe data into inventory, then access it as a reference simultaneously from multiple threads.
The flaw was corrected by enforcing that data submitted by the caller into inventory is
Sync. - Database specific
{ "severity": "MODERATE", "github_reviewed": true, "cwe_ids": [], "nvd_published_at": null, "github_reviewed_at": "2023-09-11T20:43:41Z" }- References
Affected packages
crates.io / inventory
Package
- Name
- inventory
- View open source insights on deps.dev
- Purl
- pkg:cargo/inventory