GHSA-8q2v-67v7-6vc6

Data races in rocket

Source: GitHub Advisory Database (reviewed) High CVE-2020-35882

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	rocket	>= 0.4.0, < 0.4.5	0.4.5

Details

As written in the advisory (Markdown source, shown as plain text).

The affected version of rocket contains a Clone trait implementation of LocalRequest that reuses the pointer to inner Request object. This causes data race in rare combinations of APIs if the original and the cloned objects are modified at the same time.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-35882 advisory
https://github.com/SergioBenitez/Rocket/issues/1312 web
https://github.com/SergioBenitez/Rocket package
https://rustsec.org/advisories/RUSTSEC-2020-0028.html web