GHSA-9pp4-8p8v-g78w

Source

https://github.com/advisories/GHSA-9pp4-8p8v-g78w

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-9pp4-8p8v-g78w/GHSA-9pp4-8p8v-g78w.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9pp4-8p8v-g78w

Aliases

CVE-2020-36457
RUSTSEC-2020-0137

Published

2021-08-25T20:57:26Z

Modified

2023-11-08T04:03:46Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Data races in lever

Details

An issue was discovered in the lever crate before 0.1.1 for Rust. AtomicBox implements the Send and Sync traits for all types T. This allows non-Send types such as Rc and non-Sync types such as Cell to be used across thread boundaries which can trigger undefined behavior and memory corruption.

Database specific

{
    "cwe_ids": [
        "CWE-362",
        "CWE-77"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-18T20:22:32Z",
    "nvd_published_at": "2021-08-08T06:15:00Z",
    "severity": "HIGH"
}

References

Affected packages

crates.io / lever

Package

Name: lever; View open source insights on deps.dev
Purl: pkg:cargo/lever

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.1.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-9pp4-8p8v-g78w/GHSA-9pp4-8p8v-g78w.json"