HIGH7.0

GHSA-wr55-mf5c-hhwm

Data races in late-static

Details

Affected versions of this crate implemented Sync for LateStatic with T: Send, so that it is possible to create a data race to a type T: Send + !Sync (e.g. Cell<T>).

This can result in a memory corruption or other kinds of undefined behavior.

The flaw was corrected in commit 11f396c by replacing the T: Send bound to T: Sync bound in the Sync impl for LateStatic<T>.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/late-static

Introduced in: 0Fixed in: 0.4.0

Upgrade late-static to 0.4.0 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2020-36209[ADVISORY]
https://github.com/Richard-W/late-static/issues/1[WEB]
https://github.com/Richard-W/late-static/commit/11f396c[WEB]
https://github.com/Richard-W/late-static[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2020-0102.html[WEB]