GHSA-x4qm-mcjq-v2gf

Overflow in prost-types

Source: GitHub Advisory Database (reviewed) High CVE-2021-38192

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	prost-types	< 0.8.0	0.8.0

Details

As written in the advisory (Markdown source, shown as plain text).

Affected versions of this crate contained a bug in which untrusted input could cause an overflow and panic when converting a Timestamp to SystemTime. It is recommended to upgrade to prost-types v0.8 and switch the usage of From<Timestamp> for SystemTime to TryFrom<Timestamp> for SystemTime.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-38192 advisory
https://github.com/tokio-rs/prost/issues/438 web
https://github.com/tokio-rs/prost/pull/439 web
https://github.com/tokio-rs/prost/commit/59f2a7311dd6540696bfd0145f5281ce495f4385 web
https://github.com/tokio-rs/prost/tree/master/prost-types package
https://rustsec.org/advisories/RUSTSEC-2021-0073.html web