GHSA-r57r-j98g-587f

Source

https://github.com/advisories/GHSA-r57r-j98g-587f

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-r57r-j98g-587f/GHSA-r57r-j98g-587f.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-r57r-j98g-587f

Aliases

Published

2022-01-06T22:08:56Z

Modified

2023-11-08T04:07:22.929289Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Pointer dereference in nanorand

Details

An issue was discovered in the nanorand crate before 0.6.1 for Rust. There can be multiple mutable references to the same object because the TlsWyRand Deref implementation dereferences a raw pointer.

Database specific

{
    "nvd_published_at": "2021-12-27T00:15:00Z",
    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-05T23:20:00Z"
}

References

Affected packages

crates.io / nanorand

Package

Name: nanorand; View open source insights on deps.dev
Purl: pkg:cargo/nanorand

Affected ranges

Type: SEMVER
Events: Introduced

0.5.0

Fixed

0.6.1

Ecosystem specific

{
    "affected_functions": [
        "nanorand::tls::tls_rand"
    ]
}