HIGH7.5

GHSA-7j44-fv4x-79g9

Improper Input Validation in once_cell

Details

If during the first dereference of Lazy the initialization function panics, subsequent dereferences will execute std::hints::unreachable_unchecked. Applications with panic = "abort" are not affected, as there will be no subsequent dereferences.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/once_cell

Introduced in: 0.2.5Fixed in: 1.0.1

Upgrade once_cell to 1.0.1 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2019-16141[ADVISORY]
https://github.com/matklad/once_cell/issues/46[WEB]
https://github.com/matklad/once_cell/pull/47[WEB]
https://github.com/matklad/once_cell/commit/afcca95a05240ebd931ab20998c946f77ef1e284[WEB]
https://github.com/matklad/once_cell[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2019-0017.html[WEB]