HIGH7.8

GHSA-cgmg-2v6m-fjg7

Free of uninitialized memory in autorand

Details

An issue was discovered in the autorand crate before 0.2.3 for Rust. Because of impl Random on arrays, uninitialized memory can be dropped when a panic occurs, leading to memory corruption.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/autorand

Introduced in: 0Fixed in: 0.2.3

Upgrade autorand to 0.2.3 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2020-36210[ADVISORY]
https://github.com/mersinvald/autorand-rs/issues/5[WEB]
https://github.com/mersinvald/autorand-rs[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2020-0103.html[WEB]