high7.5
CVE-2020-36465
Use after free in generic-array
Impact
An issue was discovered in the generic-array crate before 0.13.3 for Rust. It violates soundness by using the arr! macro to extend lifetimes.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | generic-array | >= 0.13.0, < 0.13.3 | 0.13.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Generic-Array Project | Generic-Array | from 0.8.0 before 0.8.4 from 0.9.0 before 0.9.1 from 0.10.0 before 0.10.1 from 0.11.0 before 0.11.2 from 0.12.0 before 0.12.4 from 0.13.0 before 0.13.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/generic-array/RUSTSEC-2020-0146.md
- https://rustsec.org/advisories/RUSTSEC-2020-0146.html
- https://github.com/advisories/GHSA-3358-4f7f-p4j4
- https://nvd.nist.gov/vuln/detail/CVE-2020-36465
- https://github.com/fizyk20/generic-array/issues/98