PT-2021-24267 · Unknown · Messagepack-Rs
Published
2021-01-26
·
Updated
2022-06-17
·
CVE-2021-45693
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
messagepack-rs crate through 2021-01-26
Description:
The issue in the messagepack-rs crate allows functions such as
deserialize binary, deserialize string, deserialize extension others, and deserialize string primitive to read from uninitialized memory locations. This can result in safe Read implementations reading from the uninitialized buffer, leading to undefined behavior.Recommendations:
For versions of the messagepack-rs crate through 2021-01-26, consider disabling the
deserialize binary, deserialize string, deserialize extension others, and deserialize string primitive functions until a patch is available to prevent reading from uninitialized memory locations. Restrict access to these functions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Use of Uninitialized Resource
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Messagepack-Rs