PT-2021-21994 · Anymap+1 · Anymap+1

Published 2021-05-07 · Updated 2021-08-25 · CVE-2021-38187

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: anymap crate versions prior to 0.12.1

Description: The issue concerns a soundness bug in the anymap crate, which is caused by the conversion of a *u8 to a *u64. This bug violates soundness. The crate does not appear to be maintained, and the most recent published version 0.12.1 includes this soundness bug.

Recommendations: For anymap crate versions prior to 0.12.1, consider updating to a manually patched version that includes the fix for the soundness bug, as the official fix was never released. As a temporary workaround, consider restricting the use of the anymap crate until a properly maintained version is available.

Exploit

Fix

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-681

CWE-704

Related Identifiers

CVE-2021-38187

GHSA-HC92-9H3M-C39J

RUSTSEC-2021-0065

Affected Products

Debian

Anymap

References · 14

• 🔥 https://rustsec.org/advisories/RUSTSEC-2021-0065.html · Exploit
• https://security-tracker.debian.org/tracker/CVE-2021-38187 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-38187 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2021-0065 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-38187 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38187 · Security Note
• https://osv.dev/vulnerability/GHSA-hc92-9h3m-c39j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38187 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-38187 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-38187 · Vendor Advisory
• https://github.com/chris-morgan/anymap/issues/37 · Note
• https://github.com/chris-morgan/anymap · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/anymap/RUSTSEC-2021-0065.md · Note
• https://crates.io/crates/anymap · Note