PT-2020-17614 · Ruspiro · Ruspiro-Singleton

Published 2020-11-16 · Updated 2021-08-25 · CVE-2020-36435

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ruspiro-singleton versions prior to 0.4.1

Description The issue arises from the unconditional implementation of Sync and Send in Singleton, allowing non-Sync types like Cell to be used in singletons. This can cause data races in concurrent programs. The flaw was corrected by adding trait bounds, requiring the contained type to implement Sync.

Recommendations For versions prior to 0.4.1, update to version 0.4.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of Singleton with non-Sync types to minimize the risk of data races.

Fix

Race Condition

Buffer Overflow

Weakness Enumeration

CWE-362

CWE-119

Related Identifiers

CVE-2020-36435

GHSA-FQQ2-XP7M-XVM8

RUSTSEC-2020-0115

Affected Products

Ruspiro-Singleton

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2020-36435 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36435 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fqq2-xp7m-xvm8 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0115 · Vendor Advisory
• https://github.com/RusPiRo/ruspiro-singleton/pull/11 · Note
• https://github.com/RusPiRo/ruspiro-singleton · Note
• https://github.com/RusPiRo/ruspiro-singleton/issues/10 · Note
• https://github.com/RusPiRo/ruspiro-singleton/commit/b0d2bd20eb40b9cbc2958b981ba2dcd9e6f9396e · Note
• https://crates.io/crates/ruspiro-singleton · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/ruspiro-singleton/RUSTSEC-2020-0115.md · Note
• https://rustsec.org/advisories/RUSTSEC-2020-0115.html · Note