Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

RUSTSEC-2020-0146: arr! macro erases lifetimes #1297

Closed
github-actions bot opened this issue Mar 2, 2021 · 2 comments · Fixed by #1298
Closed

RUSTSEC-2020-0146: arr! macro erases lifetimes #1297

github-actions bot opened this issue Mar 2, 2021 · 2 comments · Fixed by #1298

Comments

@github-actions
Copy link

github-actions bot commented Mar 2, 2021

arr! macro erases lifetimes

Details
Package generic-array
Version 0.12.3
URL fizyk20/generic-array#98
Date 2020-04-09
Patched versions >=0.14.0
Unaffected versions <0.8.0

Affected versions of this crate allowed unsoundly extending
lifetimes using arr! macro. This may result in a variety of
memory corruption scenarios, most likely use-after-free.

See advisory page for additional details.
@jyn514
Copy link
Member

jyn514 commented Mar 2, 2021

See #1295.

@mbrubeck
Copy link

mbrubeck commented Mar 2, 2021

generic-array 0.12.4 has now been released, so you can now fix this by running:

cargo update -p generic-array:0.12.3

@jyn514 jyn514 mentioned this issue Mar 2, 2021
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Update generic-array to a version without vulnerability jyn514/docs.rs
2 participants
@mbrubeck @jyn514