HIGH8.1

GHSA-9pp4-8p8v-g78w

Data races in lever

Details

An issue was discovered in the lever crate before 0.1.1 for Rust. AtomicBox<T> implements the Send and Sync traits for all types T. This allows non-Send types such as Rc and non-Sync types such as Cell to be used across thread boundaries which can trigger undefined behavior and memory corruption.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/lever

Introduced in: 0Fixed in: 0.1.1

Upgrade lever to 0.1.1 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2020-36457[ADVISORY]
https://github.com/vertexclique/lever/issues/15[WEB]
https://github.com/vertexclique/lever/pull/17[WEB]
https://github.com/vertexclique/lever/commit/4a4cca61cdb25061967d58522229e147483007b1[WEB]
https://github.com/vertexclique/lever[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2020-0137.html[WEB]