PT-2021-24258 · Flumedb · Flumedb
Published
2021-01-07
·
Updated
2022-06-16
·
CVE-2021-45684
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
flumedb crate through 2021-01-07
Description:
The issue allows arbitrary Read implementations to read from an uninitialized buffer, potentially exposing memory and returning incorrect byte counts. This can lead to undefined behavior due to the reading of uninitialized memory locations. The affected functions are
go offset log::read entry() and offset log::read entry().Recommendations:
For versions of the flumedb crate through 2021-01-07, consider restricting the use of the
go offset log::read entry() and offset log::read entry() functions until a patch is available to prevent arbitrary Read implementations from accessing uninitialized buffers.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Use of Uninitialized Resource
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Flumedb