GHSA-9qxh-258v-666c: owning_ref vulnerable to multiple soundness issues

August 10, 2022

OwningRef::map_with_owner is unsound and may result in a use-after-free.
OwningRef::map is unsound and may result in a use-after-free.
OwningRefMut::as_owner and OwningRefMut::as_owner_mut are unsound and may result in a use-after-free.
The crate violates Rust’s aliasing rules, which may cause miscompilations on recent compilers that emit the LLVM noalias attribute.

No patched versions are available at this time. While a pull request with some fixes is outstanding, the maintainer appears to be unresponsive.

References

github.com/Kimundi/owning-ref-rs
github.com/advisories/GHSA-9qxh-258v-666c
github.com/noamtashma/owning-ref-unsoundness
rustsec.org/advisories/RUSTSEC-2022-0040.html

Detect and mitigate GHSA-9qxh-258v-666c with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →