27 matches found
CVE-2020-35920: Undefined Security Weakness
An issue was discovered in the socket2 crate before 0.3.16 for Rust. It has false expectations about the std::net::SocketAddr memory representation...
RUSTSEC-2020-0079 `socket2` invalidly assumes the memory layout of std::net::SocketAddr
The socket2 crate has assumed std::net::SocketAddrV4 and std::net::SocketAddrV6 have the same memory layout as the system C representation sockaddr. It has simply casted the pointers to convert the socket addresses to the system representation. The standard library does not say anything about the...
curl (>=0.4.7, <=0.4.8), dns-lookup (>=0.7.0, <=0.8.1) +5 more potentially affected by CVE-2020-35919 +1 more via socket2 (0.2.4)
socket2 CARGO version 0.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on socket2 and may be impacted: - curl =0.4.7, =0.7.0, =0.3.0-beta.1, =0.1.0, =0.2.2, =0.2.4 - miow 0.3.0 Source cves: CVE-2020-35919, CVE-2020-35920 Source advisory:...
`socket2` invalidly assumes the memory layout of std::net::SocketAddr
The socket2 crate has assumed std::net::SocketAddrV4 and std::net::SocketAddrV6 have the same memory layout as the system C representation sockaddr. It has simply casted the pointers to convert the socket addresses to the system representation. The standard library does not say anything about the...
PT-2020-17552
Name of the Vulnerable Software and Affected Versions socket2 versions prior to 0.3.16 Description The issue arises from the socket2 crate assuming that std::net::SocketAddrV4 and std::net::SocketAddrV6 have the same memory layout as the system C representation sockaddr. This assumption leads to...