~ / search / GHSA-vqx7-pw4r-29rr

GHSA-vqx7-pw4r-29rr

Out of bounds read in bumpalo

Source: GitHub Advisory Database (reviewed) High CVE-2020-35861

Packages

EcosystemPackageAffectedFixed in
crates.io bumpalo >= 3.0.0, < 3.2.1 3.2.1

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys.

References

External links from the advisory. They lead to third-party sites.