Lucene search

K
githubGitHub Advisory DatabaseGHSA-FVHR-7J8M-3CVC
HistoryAug 25, 2021 - 8:57 p.m.

Data races in appendix

2021-08-2520:57:02
CWE-362
GitHub Advisory Database
github.com
12

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

45.7%

The appendix crate implements a key-value mapping data structure called
Index<K, V> that is stored on disk. The crate allows for any type to inhabit
the generic K and V type parameters and implements Send and Sync for them
unconditionally.

Using a type that is not marked as Send or Sync with Index can allow it
to be used across multiple threads leading to data races. Additionally using
reference types for the keys or values will lead to the segmentation faults
in the crate’s code.

Affected configurations

Vulners
Node
appendix_projectappendixRange0.2.0rust
CPENameOperatorVersion
appendixle0.2.0

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

45.7%

Related for GHSA-FVHR-7J8M-3CVC