CVE-2021-29937: Free of uninitialized memory in telemetry

August 25, 2021 (updated June 14, 2022)

An issue was discovered in the telemetry crate through 0.1.2 for Rust. There is a drop of uninitialized memory if a value.clone() call panics within misc::vec_with_size()

References

github.com/Yoric/telemetry.rs
github.com/Yoric/telemetry.rs/commit/2820cf12f2e08645fd6d1f15b4a90a54d6082a81
github.com/Yoric/telemetry.rs/issues/45
github.com/advisories/GHSA-hpcx-3pw8-g3j2
nvd.nist.gov/vuln/detail/CVE-2021-29937
rustsec.org/advisories/RUSTSEC-2021-0046.html

Code Behaviors & Features

Detect and mitigate CVE-2021-29937 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →