CVE-2020-35887: Multiple security issues including data race, buffer overflow, and uninitialized memory drop in arr

August 25, 2021 (updated June 13, 2023)

arr crate contains multiple security issues. Specifically,

It incorrectly implements Sync/Send bounds, which allows to smuggle non-Sync/Send types across the thread boundary.
Index and IndexMut implementation does not check the array bound.
Array::new_from_template() drops uninitialized memory.

References

github.com/advisories/GHSA-fhvj-7f9p-w788
github.com/sjep/array
github.com/sjep/array/issues/1
nvd.nist.gov/vuln/detail/CVE-2020-35887
rustsec.org/advisories/RUSTSEC-2020-0034.html

Code Behaviors & Features

Detect and mitigate CVE-2020-35887 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →