GitHub Advisoryadvisory · crates.io

GHSA-8q2v-67v7-6vc6 Data races in rocket

HIGH Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2020-35882
Ecosystem
crates.io
Packages
rocket
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-362
Reviewed
2021-08-19

Affected packages

• crates.io rocket: >= 0.4.0, < 0.4.5 → fixed in 0.4.5

Description

The affected version of rocket contains a Clone trait implementation of LocalRequest that reuses the pointer to inner Request object. This causes data race in rare combinations of APIs if the original and the cloned objects are modified at the same time.

Related

Alias · CVE (1)

  • CVE-2020-35882 An issue was discovered in the rocket crate before 0.4.5 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References