GitHub Advisoryadvisory · crates.io
GHSA-9wgh-vjj7-7433 Mutable reference with immutable provenance in image
MEDIUM
Official page ↗
- Aliases
- CVE-2020-35916
- Ecosystem
- crates.io
- Packages
- image
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-400
- Reviewed
- 2021-08-19
Affected packages
• crates.io image: < 0.23.12 → fixed in 0.23.12
Description
A mutable reference to a struct was constructed by dereferencing a pointer obtained from slice::as_ptr. Instead, slice::as_mut_ptr should have been called on the mutable slice argument. The former performs an implicit reborrow as an immutable shared reference which does not allow writing through the derived pointer.
Related
Alias · CVE (1)
- CVE-2020-35916 An issue was discovered in the image crate before 0.23.12 for Rust. vulnerability
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-35916 advisory
- https://github.com/image-rs/image/issues/1357 web
- https://github.com/image-rs/image/pull/1358 web
- https://github.com/image-rs/image/commit/5cbe1e6767d11aff3f14c7ad69a06b04e8d583c7 web
- https://github.com/image-rs/image package
- https://rustsec.org/advisories/RUSTSEC-2020-0073.html web