CVE-2020-36437: Data race in conqueue
(updated )
Affected versions of this crate unconditionally implemented Send/Sync for QueueSender<T>, allowing to send non-Send T to other threads by invoking (&QueueSender<T>).send().
This fails to prevent users from creating data races by sending types like Rc<T> or Arc<Cell<T>> to other threads, which can lead to memory corruption. The flaw was corrected in commit 1e462c3 by imposing T: Send to both Send/Sync impls for QueueSender<T>/QueueReceiver<T>.
References
- github.com/advisories/GHSA-368f-29c3-4f2r
- github.com/longshorej/conqueue
- github.com/longshorej/conqueue/commit/1e462c32e7933821ddb26dc49fd4ffa5aeca97b8
- nvd.nist.gov/vuln/detail/CVE-2020-36437
- raw.githubusercontent.com/rustsec/advisory-db/main/crates/conqueue/RUSTSEC-2020-0117.md
- rustsec.org/advisories/RUSTSEC-2020-0117.html
Code Behaviors & Features
Detect and mitigate CVE-2020-36437 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →