GHSA-vj88-5667-w56p: Singleton lacks bounds on Send and Sync.

August 25, 2021

Singleton<T> is meant to be a static object that can be initialized lazily. In order to satisfy the requirement that static items must implement Sync, Singleton implemented both Sync and Send unconditionally.

This allows for a bug where non-Sync types such as Cell can be used in singletons and cause data races in concurrent programs.

The flaw was corrected in commit b0d2bd20e by adding trait bounds, requiring the contaiend type to implement Sync.

References

github.com/RusPiRo/ruspiro-singleton
github.com/RusPiRo/ruspiro-singleton/issues/10
github.com/advisories/GHSA-vj88-5667-w56p
rustsec.org/advisories/RUSTSEC-2020-0115.html

Code Behaviors & Features

Detect and mitigate GHSA-vj88-5667-w56p with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →