GHSA-w5cr-frph-hw7f

Use of uninitialized buffer in rkyv

Source: GitHub Advisory Database (reviewed) High CVE-2021-31919

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	rkyv	< 0.6.0	0.6.0

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-31919 advisory
https://github.com/djkoloski/rkyv/issues/113 web
https://github.com/djkoloski/rkyv/commit/9c65ae9c2c67dd949b5c3aba9b8eba6da802ab7e web
https://github.com/djkoloski/rkyv/commit/f141b560523a20557db6540576d153010bd18712 web
https://rustsec.org/advisories/RUSTSEC-2021-0054.html web