CVE-2020-36460 – model

Package

Manager: cargo
Name: model
Vulnerable Version: >=0 <=0.1.2

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS: 0.00363 pctl0.57621

Details

Data races in model `Shared` data structure in `model` crate implements `Send` and `Sync` traits regardless of the inner type. This allows safe Rust code to trigger a data race, which is undefined behavior in Rust. Users are advised to treat `Shared` as an unsafe type. It should not be used outside of the testing context, and care must be taken so that the testing code does not have a data race besides a race condition that is expected to be caught by the test.

Metadata

Created: 2021-08-25T20:56:07Z
Modified: 2021-08-24T18:00:46Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-mxv6-q98x-h958/GHSA-mxv6-q98x-h958.json
CWE IDs: ["CWE-362", "CWE-843"]
Alternative ID: GHSA-mxv6-q98x-h958
Finding: F124
Auto approve: 1