PT-2021-24271 · Molecule · Molecule

Published 2021-07-30 · Updated 2022-01-10 · CVE-2021-45697

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: molecule crate versions prior to 0.7.2

Description: An issue in the molecule crate for Rust causes an incorrect result when using the total size(..) function to partial read the length of any FixVec, due to an incorrect implementation.

Recommendations: For versions prior to 0.7.2, update to version 0.7.2 to resolve the issue. As a temporary workaround, consider using A.as slice().len() to get the total size of the FixVec if the whole FixVec is already available.

Fix

Related Identifiers

CVE-2021-45697

GHSA-6P3C-V8VC-C244

GHSA-82HM-VH7G-HRH9

RUSTSEC-2021-0103

Affected Products

Molecule

References · 11

• https://osv.dev/vulnerability/CVE-2021-45697 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-82hm-vh7g-hrh9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45697 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2021-0103 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6p3c-v8vc-c244 · Vendor Advisory
• https://github.com/nervosnetwork/molecule/security/advisories/GHSA-82hm-vh7g-hrh9 · Note
• https://github.com/nervosnetwork/molecule/pull/49 · Note
• https://github.com/nervosnetwork/molecule · Note
• https://rustsec.org/advisories/RUSTSEC-2021-0103.html · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/molecule/RUSTSEC-2021-0103.md · Note
• https://crates.io/crates/molecule · Note