Reported

November 9, 2020

Issued

January 18, 2021 (last modified: June 13, 2023)

Package

im (crates.io)

Type

INFO Unsound

Categories

• thread-safety

Aliases

• CVE-2020-36204
• GHSA-q9h2-4xhf-23xx

References

• https://github.com/bodil/im-rs/issues/157

CVSS Score

4.7 MEDIUM

CVSS Details

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality Impact

None

Integrity Impact

None

Availability Impact

High

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Patched

• >=15.1.0

Unaffected

• <12.0.0

Description

Affected versions of im contains TreeFocus that unconditionally implements Send and Sync.

This allows a data race in safe Rust code if TreeFocus is extracted from Focus type. Typical users that only use Focus type are not affected.

Advisory available under CC0-1.0 license.