GitHub Advisoryadvisory · crates.io

GHSA-hxw9-jxqw-jc8j Data races in dces

HIGH Published 2021-08-25 Modified 2021-08-24 Official page ↗
Aliases
CVE-2020-36459
Ecosystem
crates.io
Packages
dces
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-362, CWE-77
Reviewed
2021-08-18

Affected packages

• crates.io dces: <= 0.3.0 (no fix yet)

Description

An issue was discovered in the dces crate through 2020-12-09 for Rust. The World type is marked as Send but lacks bounds on its EntityStore and ComponentStore. This allows non-thread safe `EntityStore` and `ComponentStore`s to be sent across threads and cause data races.

Related

Alias · CVE (1)

  • CVE-2020-36459 An issue was discovered in the dces crate through 2020-12-09 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References