GHSA-jmwx-r3gq-qq3p: vec-const attempts to construct a Vec from a pointer to a const slice

June 17, 2022

Affected versions of this crate claimed to construct a const Vec with nonzero length and capacity, but that cannot be done because such a Vec requires a pointer from an allocator.

The implementation was later changed to just construct a std::borrow::Cow.

References

github.com/Eolu/vec-const
github.com/Eolu/vec-const/issues/1
github.com/advisories/GHSA-jmwx-r3gq-qq3p
rustsec.org/advisories/RUSTSEC-2021-0082.html

Code Behaviors & Features

Detect and mitigate GHSA-jmwx-r3gq-qq3p with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →