GHSA-8fgg-5v78-6g76

Suggest an improvement
Source
https://github.com/advisories/GHSA-8fgg-5v78-6g76
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-8fgg-5v78-6g76/GHSA-8fgg-5v78-6g76.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8fgg-5v78-6g76
Aliases
Published
2021-08-25T20:52:03Z
Modified
2023-11-08T04:05:27.850049Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Deserializing an array can free uninitialized memory in byte_struct
Details

Bytestruct stack and unpack structure as raw bytes with packed or bit field layout. An issue was discovered in the bytestruct crate before 0.6.1 for Rust. There can be a drop of uninitialized memory if a certain deserialization method panics.

Database specific 
{
    "nvd_published_at": "2021-03-05T09:15:00Z",
    "github_reviewed_at": "2021-08-19T17:25:30Z",
    "severity": "CRITICAL",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-119",
        "CWE-908"
    ]
}
References

Affected packages

crates.io / byte_struct

Package

Name
byte_struct
View open source insights on deps.dev
Purl
pkg:cargo/byte_struct

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.6.1