CRITICAL9.8

GHSA-gvcp-948f-8f2p

Use of Uninitialized Resource in libp2p-deflate

Details

An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust. An uninitialized buffer is passed to AsyncRead::poll_read(), which is a user-provided trait function.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/libp2p-deflate

Introduced in: 0Fixed in: 0.27.1

Upgrade libp2p-deflate to 0.27.1 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2020-36443[ADVISORY]
https://github.com/libp2p/rust-libp2p[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2020-0123.html[WEB]