GitHub Advisoryadvisory · crates.io

GHSA-fvhr-7j8m-3cvc Data races in appendix

MEDIUM Published 2021-08-25 Modified 2021-08-24 Official page ↗
Aliases
CVE-2020-36469
Ecosystem
crates.io
Packages
appendix
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-362
Reviewed
2021-08-18

Affected packages

• crates.io appendix: <= 0.2.0 (no fix yet)

Description

The `appendix` crate implements a key-value mapping data structure called `Index` that is stored on disk. The crate allows for any type to inhabit the generic `K` and `V` type parameters and implements Send and Sync for them unconditionally. Using a type that is not marked as `Send` or `Sync` with `Index` can allow it to be used across multiple threads leading to data races. Additionally using reference types for the keys or values will lead to the segmentation faults in the crate's code.

Related

Alias · CVE (1)

  • CVE-2020-36469 An issue was discovered in the appendix crate through 2020-11-15 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References