matklad/once_cell · Security
Improper Input Validation in once_cell
- GHSA ID
- GHSA-7j44-fv4x-79g9
- CVE ID
- CVE-2019-16141
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
If during the first dereference of Lazy the initialization function panics, subsequent dereferences will execute std::hints::unreachable_unchecked. Applications with panic = "abort" are not affected, as there will be no subsequent dereferences.
CWEs
- CWE-20 · Improper Input Validation
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-16141 ↗
- https://github.com/matklad/once_cell/issues/46 ↗
- https://rustsec.org/advisories/RUSTSEC-2019-0017.html ↗
- https://github.com/matklad/once_cell/pull/47 ↗
- https://github.com/matklad/once_cell/commit/afcca95a05240ebd931ab20998c946f77ef1e284 ↗
- https://github.com/advisories/GHSA-7j44-fv4x-79g9 ↗