medium5.9
CVE-2020-36220
Data race in va-ts
Impact
In the affected versions of this crate, Demuxer<T> unconditionally implemented Send with no trait bounds on T. This allows sending a non-Send type T across thread boundaries, which can cause undefined behavior like unlocking a mutex from a thread that didn't lock the mutex, or memory corruption from data race. The flaw was corrected in commit `0562cbf` by adding a T: Send bound to the Send impl for Demuxer<T>.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | va-ts | < 0.0.4 | 0.0.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Va-Ts Project | Va-Ts | before 0.0.4 |