medium4.7
CVE-2020-36204
Data races in im
Impact
An issue was discovered in the im crate prior to 15.1.0 for Rust. Because TreeFocus does not have bounds on its Send trait or Sync trait, a data race can occur.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | im | >= 12.0.0, < 15.1.0 | 15.1.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Im Project | Im | through 2020-11-09 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://rustsec.org/advisories/RUSTSEC-2020-0096.html
- https://github.com/advisories/GHSA-q9h2-4xhf-23xx
- https://nvd.nist.gov/vuln/detail/CVE-2020-36204
- https://github.com/bodil/im-rs/issues/157
- https://github.com/bodil/im-rs/pull/158
- https://github.com/bodil/im-rs/releases/tag/v15.1.0
- https://github.com/bodil/im-rs/commit/0b3a7b228b0fe70446393f55c8b893f349f3f6bd