CVE-2021-38192: Overflow in prost-types
(updated )
Affected versions of this crate contained a bug in which untrusted input could cause an overflow and panic when converting a Timestamp to SystemTime. It is recommended to upgrade to prost-types v0.8 and switch the usage of From for SystemTime to TryFrom for SystemTime.
References
- github.com/advisories/GHSA-x4qm-mcjq-v2gf
- github.com/tokio-rs/prost/commit/59f2a7311dd6540696bfd0145f5281ce495f4385
- github.com/tokio-rs/prost/issues/438
- github.com/tokio-rs/prost/pull/439
- github.com/tokio-rs/prost/tree/master/prost-types
- nvd.nist.gov/vuln/detail/CVE-2021-38192
- rustsec.org/advisories/RUSTSEC-2021-0073.html
Code Behaviors & Features
Detect and mitigate CVE-2021-38192 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →