GitHub Advisoryadvisory · crates.io

GHSA-w5cr-frph-hw7f Use of uninitialized buffer in rkyv

HIGH Published 2021-08-25 Modified 2021-05-25 Official page ↗
Aliases
CVE-2021-31919
Ecosystem
crates.io
Packages
rkyv
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-772, CWE-908
Reviewed
2021-05-25

Affected packages

• crates.io rkyv: < 0.6.0 → fixed in 0.6.0

Description

An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct.

Related

Alias · CVE (1)

  • CVE-2021-31919 An issue was discovered in the rkyv crate before 0.6.0 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-772 Missing Release of Resource after Effective Lifetime weakness
  • CWE-908 Use of Uninitialized Resource weakness

References