MEDIUM5.5

GHSA-wv4p-jp67-jr97

Data races in magnetic

Details

Affected versions of this crate unconditionally implemented Sync and Send traits for MPMCConsumer and MPMCProducer types. This allows users to send types that do not implement Send trait across thread boundaries, which can cause a data race. The flaw was corrected in the 2.0.1 release by adding T: Send bound to affected Sync/Send trait implementations.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/magnetic

Introduced in: 0Fixed in: 2.0.1

Upgrade magnetic to 2.0.1 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2020-35925[ADVISORY]
https://github.com/johnshaw/magnetic/issues/9[WEB]
https://github.com/johnshaw/magnetic[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2020-0088.html[WEB]