HIGH7.5

GHSA-vqx7-pw4r-29rr

Out of bounds read in bumpalo

Details

An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/bumpalo

Introduced in: 3.0.0Fixed in: 3.2.1

Upgrade bumpalo to 3.2.1 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2020-35861[ADVISORY]
https://github.com/fitzgen/bumpalo/issues/69[WEB]
https://github.com/fitzgen/bumpalo[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2020-0006.html[WEB]