GHSA-p6gj-gpc8-f8xw: Aliased mutable references from `tls_rand` & `TlsWyRand`

June 17, 2022

TlsWyRand’s implementation of Deref unconditionally dereferences a raw pointer, and returns multiple mutable references to the same object, which is undefined behavior.

References

github.com/Absolucy/nanorand-rs
github.com/Absolucy/nanorand-rs/issues/28
github.com/advisories/GHSA-p6gj-gpc8-f8xw
rustsec.org/advisories/RUSTSEC-2021-0114.html

Code Behaviors & Features

Detect and mitigate GHSA-p6gj-gpc8-f8xw with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →