PT-2021-18731 · Outer Cgi · Outer Cgi

Solrabizna · Published 2021-01-31 · Updated 2021-08-25 · CVE-2021-30454

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions outer cgi crate versions prior to 0.2.1

Description An issue in the outer cgi crate allows a user-provided Read instance to receive an uninitialized memory buffer from KeyValueReader. This can cause the Read instance to read uninitialized memory, leading to undefined behavior and miscompilations.

Recommendations For outer cgi crate versions prior to 0.2.1, update to version 0.2.1 or later to fix the issue by ensuring buffers are zero-initialized before being passed to the Read instance.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2021-30454

GHSA-6VMQ-JH76-HQ43

RUSTSEC-2021-0051

Affected Products

Outer Cgi

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2021-30454 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2021-0051 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-30454 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6vmq-jh76-hq43 · Vendor Advisory
• https://github.com/SolraBizna/outer_cgi · Note
• https://github.com/SolraBizna/outer_cgi/commit/dd59b3066e616a08e756f72de8dc3ab11b7036c4 · Note
• https://github.com/SolraBizna/outer_cgi/issues/1 · Note
• https://rustsec.org/advisories/RUSTSEC-2021-0051.html · Note
• https://crates.io/crates/outer_cgi · Note