GitHub Advisoryadvisory · crates.io
GHSA-5vwc-r48g-wj6c Abomonation transmutes &T to and from &[u8] without sufficient constraints
HIGH
Official page ↗
- Aliases
- CVE-2021-45708
- Ecosystem
- crates.io
- Packages
- abomonation
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-668
- Reviewed
- 2022-01-05
Affected packages
• crates.io abomonation: <= 0.7.3 (no fix yet)
Description
An issue was discovered in the abomonation crate through version 0.7.3 for Rust. Because transmute operations are insufficiently constrained, there can be an information leak or ASLR bypass.
Related
Alias · CVE (1)
- CVE-2021-45708 An issue was discovered in the abomonation crate through 2021-10-17 for Rust. vulnerability
Weakness · CWE (1)
- CWE-668 Exposure of Resource to Wrong Sphere weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-45708 advisory
- https://github.com/TimelyDataflow/abomonation/issues/23 web
- https://github.com/TimelyDataflow/abomonation package
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/abomonation/RUSTSEC-2021-0120.md web
- https://rustsec.org/advisories/RUSTSEC-2021-0120.html web