PT-2021-24260 · Unknown · Csv-Sniffer

Published 2021-01-05 · Updated 2022-06-16 · CVE-2021-45686

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: csv-sniffer crate through 2021-01-05

Description: The issue is related to the preamble skipcount function, which passes an uninitialized buffer to a user-provided Read implementation. This can lead to memory exposure, allowing arbitrary Read implementations to read from the uninitialized buffer and potentially return incorrect numbers of bytes written to the buffer. Reading from uninitialized memory can produce undefined values, which can quickly invoke undefined behavior.

Recommendations: For csv-sniffer crate versions through 2021-01-05, consider disabling the preamble skipcount() function as a temporary workaround until a patch is available. Restrict access to the Read implementation to minimize the risk of exploitation. Avoid using the preamble skipcount() function in the affected crate until the issue is resolved.

Fix

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

CVE-2021-45686

GHSA-9783-42PM-X5JQ

GHSA-R67P-M7G9-GXW6

RUSTSEC-2021-0088

Affected Products

Csv-Sniffer

References · 11

• https://osv.dev/vulnerability/GHSA-r67p-m7g9-gxw6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-45686 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45686 · Security Note
• https://osv.dev/vulnerability/GHSA-9783-42pm-x5jq · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2021-0088 · Vendor Advisory
• https://github.com/jblondin/csv-sniffer/issues/1 · Note
• https://github.com/jblondin/csv-sniffer · Note
• https://github.com/jblondin/csv-sniffer/pull/2 · Note
• https://crates.io/crates/csv-sniffer · Note
• https://rustsec.org/advisories/RUSTSEC-2021-0088.html · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/csv-sniffer/RUSTSEC-2021-0088.md · Note