PT-2019-14536 · Rust · Http Crate

Published 2019-09-01 · Updated 2023-11-22 · CVE-2019-16140

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions chttp crate versions prior to 0.1.3

Description An issue was discovered in the chttp crate, where there is a use-after-free during buffer conversion. The From implementation for Vec was not properly implemented, returning a vector backed by freed memory. This could lead to memory corruption or be exploited to cause undefined behavior.

Recommendations For versions prior to 0.1.3, update to version 0.1.3 to resolve the issue. As a temporary workaround, consider avoiding the use of the From implementation for Vec until the update is applied.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2019-16140

GHSA-5RRV-M36H-QWF8

RUSTSEC-2019-0016

Affected Products

Http Crate

References · 9

• https://osv.dev/vulnerability/CVE-2019-16140 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16140 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2019-0016 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5rrv-m36h-qwf8 · Vendor Advisory
• https://github.com/sagebind/isahc/issues/2 · Note
• https://github.com/sagebind/chttp · Note
• https://github.com/sagebind/isahc/commit/9e9f1fb44114078c000c78c72e691eeb9e7ac260 · Note
• https://crates.io/crates/chttp · Note
• https://rustsec.org/advisories/RUSTSEC-2019-0016.html · Note