GitHub Advisoryadvisory · crates.io

GHSA-vqx7-pw4r-29rr Out of bounds read in bumpalo

HIGH Published 2021-08-25 Modified 2021-08-19 Official page ↗
Aliases
CVE-2020-35861
Ecosystem
crates.io
Packages
bumpalo
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-125
Reviewed
2021-08-19

Affected packages

• crates.io bumpalo: >= 3.0.0, < 3.2.1 → fixed in 3.2.1

Description

An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys.

Related

Alias · CVE (1)

  • CVE-2020-35861 An issue was discovered in the bumpalo crate before 3.2.1 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References