GHSA-c8v3-jhv9-4ppc

Suggest an improvement
Source
https://github.com/advisories/GHSA-c8v3-jhv9-4ppc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-c8v3-jhv9-4ppc/GHSA-c8v3-jhv9-4ppc.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-c8v3-jhv9-4ppc
Aliases
Published
2024-01-23T20:10:48Z
Modified
2024-02-10T16:26:48.561050Z
Summary
Use-after-free when setting the locale
Details

Version 3.0.0 introduced an AtomicStr type, that is used to store the current locale. It stores the locale as a raw pointer to an Arc<String>. The locale can be read with AtomicStr::as_str(). AtomicStr::as_str() does not increment the usage counter of the Arc.

If the locale is changed in one thread, another thread can have a stale -- possibly already freed -- reference to the stored string.

Database specific 
{
    "nvd_published_at": null,
    "severity": "MODERATE",
    "github_reviewed_at": "2024-01-23T20:10:48Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-416"
    ]
}
References

Affected packages

crates.io / rust-i18n-support

Package

Name
rust-i18n-support
View open source insights on deps.dev
Purl
pkg:cargo/rust-i18n-support

Affected ranges

Type
SEMVER
Events
Introduced
3.0.0
Fixed
3.0.1