PT-2021-22000 · Unknown · Prost-Types

Published 2021-07-08 · Updated 2021-08-25 · CVE-2021-38192

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: prost-types versions prior to 0.8.0

Description: An issue was discovered in the prost-types crate where an overflow can occur during conversion from Timestamp to SystemTime. This is caused by a bug that allows untrusted input to cause an overflow and panic during the conversion process.

Recommendations: To resolve the issue, upgrade to prost-types v0.8 and switch the usage of From<Timestamp> for SystemTime to TryFrom<Timestamp> for SystemTime.

Exploit

Fix

Integer Overflow

Buffer Overflow

Weakness Enumeration

CWE-190

CWE-120

Related Identifiers

CVE-2021-38192

GHSA-X4QM-MCJQ-V2GF

RUSTSEC-2021-0073

Affected Products

Prost-Types

References · 12

• 🔥 https://rustsec.org/advisories/RUSTSEC-2021-0073.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-38192 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2021-0073 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38192 · Security Note
• https://osv.dev/vulnerability/GHSA-x4qm-mcjq-v2gf · Vendor Advisory
• https://github.com/tokio-rs/prost/commit/59f2a7311dd6540696bfd0145f5281ce495f4385 · Note
• https://github.com/tokio-rs/prost/issues/438 · Note
• https://github.com/tokio-rs/prost/tree/master/prost-types · Note
• https://github.com/tokio-rs/prost/pull/439 · Note
• https://t.me/cvenotify/18865 · Telegram Post
• https://crates.io/crates/prost-types · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/prost-types/RUSTSEC-2021-0073.md · Note