GitHub Advisoryadvisory · crates.io

GHSA-x4qm-mcjq-v2gf Overflow in prost-types

HIGH Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2021-38192
Ecosystem
crates.io
Packages
prost-types
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-120, CWE-190
Reviewed
2021-08-18

Affected packages

• crates.io prost-types: < 0.8.0 → fixed in 0.8.0

Description

Affected versions of this crate contained a bug in which untrusted input could cause an overflow and panic when converting a Timestamp to SystemTime. It is recommended to upgrade to prost-types v0.8 and switch the usage of From for SystemTime to TryFrom for SystemTime.

Related

Alias · CVE (1)

  • CVE-2021-38192 An issue was discovered in the prost-types crate before 0.8.0 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-120 Buffer Copy without Checking Size of Input weakness
  • CWE-190 Integer Overflow or Wraparound weakness

References