GHSA-6p3c-v8vc-c244

The `total_size` function for partial read the length of any `FixVec` is incorrect in molecule.

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-45697

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	molecule	< 0.7.2	0.7.2

Details

As written in the advisory (Markdown source, shown as plain text).

Anyone who uses total_size(..) function to partial read the length of any FixVec will get an incorrect result, due to an incorrect implementation. This has been resolved in the 0.7.2 release.

References

External links from the advisory. They lead to third-party sites.

https://github.com/nervosnetwork/molecule/security/advisories/GHSA-82hm-vh7g-hrh9 web
https://nvd.nist.gov/vuln/detail/CVE-2021-45697 advisory
https://github.com/nervosnetwork/molecule/pull/49 web
https://github.com/nervosnetwork/molecule package
https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/molecule/RUSTSEC-2021-0103.md web
https://rustsec.org/advisories/RUSTSEC-2021-0103.html web