MEDIUM5.9

GHSA-rmff-f8w9-c9rm

Data races in max7301

Details

The `ImmediateIO` and `TransactionalIO` types implement `Sync` for all contained `Expander<EI>` types regardless of if the `Expander` itself is safe to use across threads.

As the `IO` types allow retrieving the `Expander`, this can lead to non-thread safe types being sent across threads as part of the `Expander` leading to data races.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/max7301

Introduced in: 0Fixed in: 0.2.0

Upgrade max7301 to 0.2.0 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2020-36472[ADVISORY]
https://github.com/edarc/max7301/issues/1[WEB]
https://github.com/edarc/max7301/commit/0a1da873ddb29bca926bad8301f8d7ab8aa97c52[WEB]
https://github.com/edarc/max7301[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2020-0152.html[WEB]