CVE-2021-26305: Read of uninitialized memory in cdr

August 25, 2021

An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated heap memory, violating soundness.

References

github.com/advisories/GHSA-37jj-wp7g-7wj4
github.com/hrektts/cdr-rs
github.com/hrektts/cdr-rs/commit/0e6006de464caa331643f86cd2d9ba3b32b09833
github.com/hrektts/cdr-rs/issues/10
github.com/hrektts/cdr-rs/pull/11
nvd.nist.gov/vuln/detail/CVE-2021-26305
rustsec.org/advisories/RUSTSEC-2021-0012.html

Code Behaviors & Features

Detect and mitigate CVE-2021-26305 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →