Lucene search

K
osvGoogleOSV:RUSTSEC-2019-0034
HistoryNov 16, 2019 - 12:00 p.m.

HeaderMap::Drain API is unsound

2019-11-1612:00:00
Google
osv.dev
7

0.002 Low

EPSS

Percentile

60.7%

Affected versions of this crate incorrectly used raw pointer,
which introduced unsoundness in its public safe API.

Failing to drop the Drain struct causes double-free,
and it is possible to violate Rust’s alias rule and cause data race with Drain’s Iterator implementation.

The flaw was corrected in 0.1.20 release of http crate.

CPENameOperatorVersion
httplt0.1.20

0.002 Low

EPSS

Percentile

60.7%