GHSA-VJ88-5667-W56P中危已审查已撤回

Singleton lacks bounds on Send and Sync.

OSV 1.4.0 · github-reviewed · 修改于 2021-08-25 01:44

发布时间

2021-08-26 05:00

GitHub 审查时间

2021-08-07 03:10

NVD 发布时间

—

源文件

advisories/github-reviewed/2021/08/GHSA-vj88-5667-w56p/GHSA-vj88-5667-w56p.json

该公告已于 2021-08-25 01:44 撤回

内容仅用于保留外部引用，请不要将其当作仍然有效的安全结论。

公告说明

Singleton<T> is meant to be a static object that can be initialized lazily. In order to satisfy the requirement that static items must implement Sync, Singleton implemented both Sync and Send unconditionally.

This allows for a bug where non-Sync types such as Cell can be used in singletons and cause data races in concurrent programs.

The flaw was corrected in commit b0d2bd20e by adding trait bounds, requiring the contaiend type to implement Sync.

受影响的软件包

crates.io

ruspiro-singleton

ECOSYSTEM

标识信息

别名 / CVE

无

CWE

CWE-362

软件生态

crates.io

扩展资料

暂无扩展资料。

CVSS 评分

没有 CVSS 数据。

原始 OSV JSON

{
  "id": "GHSA-vj88-5667-w56p",
  "aliases": [],
  "details": "`Singleton<T>` is meant to be a static object that can be initialized lazily. In\norder to satisfy the requirement that `static` items must implement `Sync`,\n`Singleton` implemented both `Sync` and `Send` unconditionally.\n\nThis allows for a bug where non-`Sync` types such as `Cell` can be used in\nsingletons and cause data races in concurrent programs.\n\nThe flaw was corrected in commit `b0d2bd20e` by adding trait bounds, requiring\nthe contaiend type to implement `Sync`.\n",
  "summary": "Singleton lacks bounds on Send and Sync.",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.1"
            }
          ]
        }
      ],
      "package": {
        "name": "ruspiro-singleton",
        "ecosystem": "crates.io"
      }
    }
  ],
  "modified": "2021-08-24T17:44:58Z",
  "severity": [],
  "published": "2021-08-25T21:00:11Z",
  "withdrawn": "2021-08-24T17:44:58Z",
  "references": [
    {
      "url": "https://github.com/RusPiRo/ruspiro-singleton/issues/10",
      "type": "WEB"
    },
    {
      "url": "https://github.com/RusPiRo/ruspiro-singleton",
      "type": "PACKAGE"
    },
    {
      "url": "https://rustsec.org/advisories/RUSTSEC-2020-0115.html",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2021-08-06T19:10:18Z"
  }
}