PT-2021-24265 · Unknown · Messagepack-Rs
Published
2021-01-26
·
Updated
2022-06-17
·
CVE-2021-45691
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
messagepack-rs crate through 2021-01-26
Description:
An issue was discovered in the messagepack-rs crate where certain functions may read from uninitialized memory locations, leading to undefined behavior. The affected functions include
deserialize binary, deserialize string, deserialize extension others, and deserialize string primitive. These functions pass an uninitialized buffer to a user-provided Read instance, which can result in safe Read implementations reading from the uninitialized buffer.Recommendations:
For the messagepack-rs crate through 2021-01-26, consider disabling the
deserialize binary, deserialize string, deserialize extension others, and deserialize string primitive functions until a patch is available to prevent reading from uninitialized memory locations. Restrict access to these functions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Use of Uninitialized Resource
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Messagepack-Rs