CRITICAL9.8

GHSA-gx73-2498-r55c

Unsound casting in flatbuffers

Details

The implementation of impl Follow for bool allows to reinterpret arbitrary bytes as a bool.

In Rust bool has stringent requirements for its in-memory representation. Use of this function allows to violate these requirements and invoke undefined behaviour in safe code.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/flatbuffers

Introduced in: 0.4.0Fixed in: 0.6.1

Upgrade flatbuffers to 0.6.1 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2019-25004[ADVISORY]
https://github.com/google/flatbuffers/issues/5530[WEB]
https://github.com/google/flatbuffers[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2019-0028.html[WEB]