GHSA-gq4h-f254-7cw9: Data races in ticketed_lock
(updated )
Affected versions of this crate unconditionally implemented Send
for ReadTicket<T>
& WriteTicket<T>
.
This allows to send non-Send T
to other threads.
This can allows creating data races by cloning types with internal mutability and sending them to other threads (as T
of ReadTicket<T>
/WriteTicket<T>
). Such data races can cause memory corruption or other undefined behavior.
The flaw was corrected in commit a986a93
by adding T: Send
bounds to Send
impls of ReadTicket<T>
/WriteTicket<T>
.
References
Detect and mitigate GHSA-gq4h-f254-7cw9 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →