GHSA-7j44-fv4x-79g9

Improper Input Validation in once_cell

Source: GitHub Advisory Database (reviewed) High CVE-2019-16141

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	once_cell	>= 0.2.5, < 1.0.1	1.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

If during the first dereference of Lazy the initialization function panics, subsequent dereferences will execute std::hints::unreachable_unchecked. Applications with panic = "abort" are not affected, as there will be no subsequent dereferences.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-16141 advisory
https://github.com/matklad/once_cell/issues/46 web
https://github.com/matklad/once_cell/pull/47 web
https://github.com/matklad/once_cell/commit/afcca95a05240ebd931ab20998c946f77ef1e284 web
https://github.com/matklad/once_cell package
https://rustsec.org/advisories/RUSTSEC-2019-0017.html web