HIGH8.1

GHSA-fg42-vwxx-xx5j

Data race in tiny_future

Details

tiny_future contains a light-weight implementation of Futures. The Future type it has lacked bound on its Send and Sync traits. This allows for a bug where non-thread safe types such as Cell can be used in Futures and cause data races in concurrent programs. The flaw was corrected in commit `c791919` by adding trait bounds to Future's Send and Sync.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/tiny_future

Introduced in: 0Fixed in: 0.4.0

Upgrade tiny_future to 0.4.0 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2020-36438[ADVISORY]
https://github.com/KizzyCode/tiny_future/issues/1[WEB]
https://github.com/KizzyCode/tiny_future-rust/commit/c7919199a0f6d1ce0e3c33499d1b37f862c990e4[WEB]
https://github.com/KizzyCode/tiny_future[PACKAGE]
https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tiny_future/RUSTSEC-2020-0118.md[WEB]
https://rustsec.org/advisories/RUSTSEC-2020-0118.html[WEB]