GitHub Advisoryadvisory · crates.io

GHSA-3837-87vh-xq3w Data race in v9

HIGH Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2020-36447
Ecosystem
crates.io
Packages
v9
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77
Reviewed
2021-08-18

Affected packages

• crates.io v9: < 0.1.43 → fixed in 0.1.43

Description

Affected versions of this crate unconditionally implement Sync for SyncRef. This definition allows data races if &T is accessible through &SyncRef. SyncRef derives Clone and Debug, and the default implementations of those traits access &T by invoking T::clone() & T::fmt(). It is possible to create data races & undefined behavior by concurrently invoking SyncRef::clone() or SyncRef::fmt() from multiple threads with T: !Sync.

Related

Alias · CVE (1)

  • CVE-2020-36447 An issue was discovered in the v9 crate through 2020-12-18 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References