Reported

January 26, 2021

Issued

August 21, 2021 (last modified: June 13, 2023)

Package

messagepack-rs (crates.io)

Type

Vulnerability

Categories

• memory-exposure

Aliases

• CVE-2021-45690
• CVE-2021-45691
• CVE-2021-45692
• CVE-2021-45693
• GHSA-hr52-f9vp-582c
• GHSA-jqjj-r4qp-x2gh
• GHSA-jwfh-j623-m97h
• GHSA-m325-rxjv-pwph
• GHSA-vw5m-qw2r-m923

References

• https://github.com/otake84/messagepack-rs/issues/2

Patched

no patched versions

Description

Affected versions of this crate passed an uninitialized buffer to a user-provided Read instance in:

• deserialize_binary
• deserialize_string
• deserialize_extension_others
• deserialize_string_primitive

This can result in safe Read implementations reading from the uninitialized buffer leading to undefined behavior.

Advisory available under CC0-1.0 license.