GHSA-wcm8-86x6-8mv3

Source

https://github.com/advisories/GHSA-wcm8-86x6-8mv3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-wcm8-86x6-8mv3/GHSA-wcm8-86x6-8mv3.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-wcm8-86x6-8mv3

Aliases

CVE-2022-36124

Published

2022-08-10T00:00:31Z

Modified

2023-11-08T04:10:01.840779Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Apache Avro Rust SDK's Reader could consume memory beyond allowed constraints

Details

It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.

Database specific

{
    "nvd_published_at": "2022-08-09T07:15:00Z",
    "github_reviewed_at": "2022-08-30T20:05:09Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-770"
    ]
}

References

Affected packages

crates.io / apache-avro

Package

Name: apache-avro; View open source insights on deps.dev
Purl: pkg:cargo/apache-avro

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.14.0