MEDIUM4.7

GHSA-4xj5-vv9x-63jp

Data races in concread

Details

An issue was discovered in the concread crate before 0.2.6 for Rust. Attackers can cause an ARCache<K,V> data race by sending types that do not implement Send/Sync.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/concread

Introduced in: 0Fixed in: 0.2.6

Upgrade concread to 0.2.6 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2020-35928[ADVISORY]
https://github.com/kanidm/concread/issues/48[WEB]
https://github.com/kanidm/concread[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2020-0092.html[WEB]