sergiobenitez/rocket · Security
Data races in rocket
- GHSA ID
- GHSA-8q2v-67v7-6vc6
- CVE ID
- CVE-2020-35882
- Severity
- high
- Published
- Updated
- CVSS
- 8.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 8.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
The affected version of rocket contains a Clone trait implementation of LocalRequest that reuses the pointer to inner Request object. This causes data race in rare combinations of APIs if the original and the cloned objects are modified at the same time.
CWEs
- CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')