Lucene search

GitHub Advisory DatabaseGHSA-Q9H2-4XHF-23XX

HistoryAug 25, 2021 - 8:51 p.m.

Data races in im

2021-08-2520:51:36

CWE-662

GitHub Advisory Database

github.com

data race

im crate

treefocus

rust

software

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:N/I:N/A:P

CVSS3

4.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

Percentile

12.8%

JSON

An issue was discovered in the im crate prior to 15.1.0 for Rust. Because TreeFocus does not have bounds on its Send trait or Sync trait, a data race can occur.

Affected configurations

Vulners

Node

imRange12.0.0–15.1.0

VendorProductVersionCPE
*im*cpe:2.3:a:*:im:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
*	im	*	cpe:2.3:a::im::::::::*

References

github.com/advisories/GHSA-q9h2-4xhf-23xx

github.com/bodil/im-rs/commit/0b3a7b228b0fe70446393f55c8b893f349f3f6bd

github.com/bodil/im-rs/issues/157

github.com/bodil/im-rs/pull/158

github.com/bodil/im-rs/releases/tag/v15.1.0

nvd.nist.gov/vuln/detail/CVE-2020-36204

rustsec.org/advisories/RUSTSEC-2020-0096.html

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:N/I:N/A:P

CVSS3

4.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

Percentile

12.8%

JSON

Related for GHSA-Q9H2-4XHF-23XX