GHSA-p6gj-gpc8-f8xw: Aliased mutable references from `tls_rand` & `TlsWyRand`

June 17, 2022

TlsWyRand’s implementation of Deref unconditionally dereferences a raw pointer, and returns multiple mutable references to the same object, which is undefined behavior.

References

github.com/Absolucy/nanorand-rs
github.com/Absolucy/nanorand-rs/issues/28
github.com/advisories/GHSA-p6gj-gpc8-f8xw
rustsec.org/advisories/RUSTSEC-2021-0114.html

Code Behaviors & Features

Detect and mitigate GHSA-p6gj-gpc8-f8xw with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →