PT-2020-17575 · Rust · Im

Published 2020-11-09 · Updated 2021-08-25 · CVE-2020-36204

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions im versions prior to 15.1.0 im versions through 2020-11-09

Description An issue in the im crate allows a data race to occur because TreeFocus does not have bounds on its Send trait or Sync trait. This can happen when TreeFocus is extracted from the Focus type, potentially affecting safe Rust code. Typical users who only use the Focus type are not affected.

Recommendations For im versions prior to 15.1.0, update to version 15.1.0 or later to resolve the issue. For im versions through 2020-11-09, update to a version released after 2020-11-09 to resolve the issue. As a temporary workaround, consider avoiding the extraction of TreeFocus from the Focus type until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-662

Related Identifiers

CVE-2020-36204

GHSA-Q9H2-4XHF-23XX

RUSTSEC-2020-0096

Affected Products

Im

References · 12

• 🔥 https://rustsec.org/advisories/RUSTSEC-2020-0096.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-36204 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36204 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2020-0096 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q9h2-4xhf-23xx · Vendor Advisory
• https://github.com/bodil/im-rs/pull/158 · Note
• https://github.com/bodil/im-rs/releases/tag/v15.1.0 · Note
• https://github.com/bodil/im-rs · Note
• https://github.com/bodil/im-rs/commit/0b3a7b228b0fe70446393f55c8b893f349f3f6bd · Note
• https://github.com/bodil/im-rs/issues/157 · Note
• https://crates.io/crates/im · Note
• https://t.me/cvenotify/9309 · Telegram Post