HistoryEdit

RUSTSEC-2021-0051

KeyValueReader passes uninitialized memory to Read instance

Reported
Issued
Package
outer_cgi (crates.io)
Type
Vulnerability
Categories
Aliases
Details
https://github.com/SolraBizna/outer_cgi/issues/1
CVSS Score
9.8 CRITICAL
CVSS Details
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Patched
  • >=0.2.1

Description

The KeyValueReader type in affected versions of this crate set up an uninitialized memory buffer and passed them to be read in to a user-provided Read instance.

The Read instance could read uninitialized memory and cause undefined behavior and miscompilations.

This issue was fixed in commit dd59b30 by zero-initializing the buffers before passing them.