PT-2021-17194 · Unknown · Postscript

Published 2021-01-30 · Updated 2021-08-25 · CVE-2021-26953

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: postscript crate versions prior to 0.14.0

Description: The issue allows attackers to obtain sensitive information from uninitialized memory locations via a user-provided Read implementation. Affected versions of the crate pass an uninitialized buffer to a user-provided Read implementation, which can read from the uninitialized buffer, causing memory exposure, and return an incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.

Recommendations: For versions prior to 0.14.0, update to version 0.14.0 or later, which includes the fix for this issue by zero-initializing the buffer before handing it to a user-provided Read implementation. As a temporary workaround, consider restricting the use of user-provided Read implementations until the issue is resolved.

Exploit

Fix

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

CVE-2021-26953

GHSA-FHVC-GP6C-H2WX

RUSTSEC-2021-0017

Affected Products

Postscript

References · 10

• 🔥 https://rustsec.org/advisories/RUSTSEC-2021-0017.html · Exploit
• https://osv.dev/vulnerability/GHSA-fhvc-gp6c-h2wx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-26953 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26953 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2021-0017 · Vendor Advisory
• https://github.com/bodoni/postscript/commit/8026286 · Note
• https://github.com/bodoni/postscript/issues/1 · Note
• https://github.com/bodoni/postscript · Note
• https://crates.io/crates/postscript · Note
• https://t.me/cvenotify/9695 · Telegram Post