CVE-2021-45692

Critical

An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_extension_others may read from uninitialized…

mitre·CWE-908·Published 2021-12-26

CVSS

9.8

EPSS

0.01

KEV

Exploits

cve.orgen

155 chars

An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_extension_others may read from uninitialized memory locations.

NVDen

155 chars

An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_extension_others may read from uninitialized memory locations.

Affected versions of this crate passed an uninitialized buffer to a user-provided `Read` instance in: * `deserialize_binary` * `deserialize_string` * `deserialize_extension_others` * `deserialize_string_primitive` This can result in safe `Read` implementations reading from the uninitialized buffer leading to undefined behavior.

GHSAen

155 chars

An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_extension_others may read from uninitialized memory locations.

NVDes

189 chars

Se ha detectado un problema en la crate messagepack-rs versiones hasta 26-01-2021 para Rust. La función deserialize_extension_others puede leer desde ubicaciones de memoria no inicializadas

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	7.5	10.0	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P
3.1	Primary	NVD	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.1	Secondary	GHSA	9.8	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H