CVE-2021-31919: Use of uninitialized buffer in rkyv
An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct.
References
- github.com/advisories/GHSA-w5cr-frph-hw7f
- github.com/djkoloski/rkyv/commit/9c65ae9c2c67dd949b5c3aba9b8eba6da802ab7e
- github.com/djkoloski/rkyv/commit/f141b560523a20557db6540576d153010bd18712
- github.com/djkoloski/rkyv/issues/113
- nvd.nist.gov/vuln/detail/CVE-2021-31919
- rustsec.org/advisories/RUSTSEC-2021-0054.html
Detect and mitigate CVE-2021-31919 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →