CVE-2020-36445: Data races in convec
Affected versions of this crate unconditionally implement Send/Sync for ConVec<T>
.
This allows users to insert T
that is not Send or not Sync.
This allows users to create data races by using non-Send types like Arc<Cell<_>>
or Rc<_>
as T
in ConVec<T>
. It is also possible to create data races by using types like Cell<_>
or RefCell<_>
as T
(types that are Send
but not Sync
).
Such data races can lead to memory corruption.
References
Detect and mitigate CVE-2020-36445 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →