Lucene search

GitHub Advisory DatabaseGHSA-QG24-8XJ4-GJ2H

HistoryAug 25, 2021 - 8:58 p.m.

Unaligned memory allocation in chunky

2021-08-2520:58:13

CWE-758

GitHub Advisory Database

github.com

chunky crate

rust

memory allocation

alignment requirement

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

30.9%

JSON

An issue was discovered in the chunky crate through 2020-08-25 for Rust. The Chunk API does not honor an alignment requirement.

Affected configurations

Vulners

Node

chunkyRange≤0.3.7

VendorProductVersionCPE
*chunky*cpe:2.3:a:*:chunky:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
*	chunky	*	cpe:2.3:a::chunky::::::::*

References

github.com/advisories/GHSA-qg24-8xj4-gj2h

github.com/aeplay/chunky/issues/2

nvd.nist.gov/vuln/detail/CVE-2020-36433

rustsec.org/advisories/RUSTSEC-2020-0035.html

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

30.9%

JSON

Related for GHSA-QG24-8XJ4-GJ2H