Описание
Data race in ruspiro-singleton
Singleton<T> is meant to be a static object that can be initialized lazily. In
order to satisfy the requirement that static items must implement Sync,
Singleton implemented both Sync and Send unconditionally.
This allows for a bug where non-Sync types such as Cell can be used in
singletons and cause data races in concurrent programs.
The flaw was corrected in commit b0d2bd20e by adding trait bounds, requiring
the contaiend type to implement Sync.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2020-36435
- https://github.com/RusPiRo/ruspiro-singleton/issues/10
- https://github.com/RusPiRo/ruspiro-singleton/pull/11
- https://github.com/RusPiRo/ruspiro-singleton/commit/b0d2bd20eb40b9cbc2958b981ba2dcd9e6f9396e
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/ruspiro-singleton/RUSTSEC-2020-0115.md
- https://rustsec.org/advisories/RUSTSEC-2020-0115.html
Пакеты
Наименование
ruspiro-singleton
rust
Затронутые версииВерсия исправления
< 0.4.1
0.4.1
Связанные уязвимости
CVSS3: 8.1
nvd
больше 4 лет назад
An issue was discovered in the ruspiro-singleton crate before 0.4.1 for Rust. In Singleton, Send and Sync do not have bounds checks.