GHSA-2326-pfpj-vx3h
Suggest an improvement- Source
- https://github.com/advisories/GHSA-2326-pfpj-vx3h
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-2326-pfpj-vx3h/GHSA-2326-pfpj-vx3h.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-2326-pfpj-vx3h
- Published
- 2024-09-16T17:19:01Z
- Modified
- 2024-09-16T17:19:01Z
- Summary
- lexical-core has multiple soundness issues
- Details
-
RUSTSEC-2024-0377contains multiple soundness issues:- Bytes::read() allows creating instances of types with invalid bit patterns
- BytesIter::read() advances iterators out of bounds
- The
BytesItertrait has safety invariants but is public and not markedunsafe write_float()callsMaybeUninit::assume_init()on uninitialized data, which is is not allowed by the Rust abstract machineradix()callsMaybeUninit::assume_init()on uninitialized data, which is is not allowed by the Rust abstract machine
Version 1.0 fixes these issues, removes the vast majority of
unsafecode, and also fixes some correctness issues. - References
-
- https://github.com/Alexhuszagh/rust-lexical/issues/101
- https://github.com/Alexhuszagh/rust-lexical/issues/102
- https://github.com/Alexhuszagh/rust-lexical/issues/104
- https://github.com/Alexhuszagh/rust-lexical/issues/126
- https://github.com/Alexhuszagh/rust-lexical/issues/95
- https://github.com/Alexhuszagh/rust-lexical
- https://github.com/advisories/GHSA-c2hm-mjxv-89r4
- https://rustsec.org/advisories/RUSTSEC-2023-0055
- https://rustsec.org/advisories/RUSTSEC-2023-0086.html
Affected packages
crates.io / lexical-core
Package
- Name
- lexical-core
- View open source insights on deps.dev
- Purl
- pkg:cargo/lexical-core