HIGH8.1

GHSA-8q2v-67v7-6vc6

Data races in rocket

Details

The affected version of rocket contains a Clone trait implementation of LocalRequest that reuses the pointer to inner Request object. This causes data race in rare combinations of APIs if the original and the cloned objects are modified at the same time.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/rocket

Introduced in: 0.4.0Fixed in: 0.4.5

Upgrade rocket to 0.4.5 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2020-35882[ADVISORY]
https://github.com/SergioBenitez/Rocket/issues/1312[WEB]
https://github.com/SergioBenitez/Rocket[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2020-0028.html[WEB]