HIGH7.5

GHSA-9pqx-g3jh-qpqq

Dangling reference in `access::Map` with Constant

Details

An issue has been discovered in the arc-swap crate before 0.4.8 (and 1.x before 1.1.0) for Rust. Use of arc_swap::access::Map with the Constant test helper (or with a user-supplied implementation of the Access trait) could sometimes lead to dangling references being returned by the map.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/arc-swap

Introduced in: 0.4.2Fixed in: 0.4.8

Upgrade arc-swap to 0.4.8 or newer (ecosystem crates.io).

crates.io/arc-swap

Introduced in: 1.0.0Fixed in: 1.1.0

Upgrade arc-swap to 1.1.0 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2020-35711[ADVISORY]
https://github.com/vorner/arc-swap/issues/45[WEB]
https://github.com/vorner/arc-swap[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2020-0091.html[WEB]