GHSA-h588-76vg-prgj: `DecimalArray` does not perform bound checks on accessing values and offsets

June 16, 2022 (updated February 9, 2023)

DecimalArray performs insufficient bounds checks, which allows out-of-bounds reads in safe code if the lenght of the backing buffer is not a multiple of 16.

References

github.com/advisories/GHSA-h588-76vg-prgj
github.com/apache/arrow-rs
github.com/apache/arrow-rs/issues/775
rustsec.org/advisories/RUSTSEC-2021-0117.html

Detect and mitigate GHSA-h588-76vg-prgj with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →