Lucene search

GitHub Advisory DatabaseGHSA-5R9G-J7JJ-HW6C

HistoryMay 24, 2022 - 5:37 p.m.

Improper `Sync` implementation on `FuturesUnordered` in futures-utils can cause data corruption

2022-05-2417:37:49

GitHub Advisory Database

github.com

futures-util crate

data corruption

sync mishandling

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

Percentile

12.6%

JSON

An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled.

Affected configurations

Vulners

Node

futures-utilRange0.3.0–0.3.2

VendorProductVersionCPE
*futures-util*cpe:2.3:a:*:futures-util:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
*	futures-util	*	cpe:2.3:a::futures-util::::::::*

References

github.com/advisories/GHSA-5r9g-j7jj-hw6c

github.com/rust-lang/futures-rs/issues/2050

nvd.nist.gov/vuln/detail/CVE-2020-35908

rustsec.org/advisories/RUSTSEC-2020-0062.html

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

Percentile

12.6%

JSON

Related for GHSA-5R9G-J7JJ-HW6C