In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the same string.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade cargo-docUpgrade rust-analysisUpgrade rust-debugger-commonUpgrade rust-srcUpgrade rust-lldbUpgrade rustUpgrade rustfmtUpgrade rust-std-staticUpgrade rust-docUpgrade rlsUpgrade rust-toolsetUpgrade rust-gdbUpgrade cargoUpgrade clippy | May 4, 2022 | Apr 11, 2021 |
| Centos_linux | — | Upgrade rust-srcUpgrade rustfmt-debuginfoUpgrade rust-std-staticUpgrade rustUpgrade clippyUpgrade cargo-docUpgrade cargoUpgrade rust-analysisUpgrade rust-debugger-commonUpgrade rustfmtUpgrade rust-docUpgrade rust-lldbUpgrade rust-toolsetUpgrade rls-debuginfoUpgrade rust-debugsourceUpgrade cargo-debuginfoUpgrade rust-gdbUpgrade rust-debuginfoUpgrade clippy-debuginfoUpgrade rls | Jun 1, 2021 | Apr 11, 2021 |
| Debian | — | Upgrade rustc | Jul 30, 2024 | Apr 11, 2021 |
| Oracle Solaris | — | Upgrade developer/rust/rustc to version 1.53.0-11.4.39.0.1.107.0 on Solaris 11.4Upgrade developer/rust/cargo to version 1.53.0-11.4.39.0.1.107.0 on Solaris 11.4 | Nov 17, 2021 | Apr 11, 2021 |
| Oracle_linux | — | Upgrade rust-docUpgrade cargoUpgrade clippyUpgrade rustUpgrade rlsUpgrade rust-gdbUpgrade rust-toolsetUpgrade rust-srcUpgrade rustfmtUpgrade rust-lldbUpgrade rust-std-staticUpgrade rust-analysisUpgrade cargo-docUpgrade rust-debugger-common | May 26, 2021 | Oct 28, 2020 |
| Redhat_linux | — | Upgrade rust-lldbUpgrade rust-std-staticUpgrade rls-debuginfoUpgrade rustfmt-debuginfoUpgrade rust-debuginfoUpgrade rust-docUpgrade rustfmtUpgrade rust-srcUpgrade cargoUpgrade rust-debugger-commonUpgrade cargo-docUpgrade rust-analysisUpgrade rustUpgrade rlsUpgrade clippyUpgrade cargo-debuginfoUpgrade rust-debugsourceUpgrade rust-gdbUpgrade rust-toolsetUpgrade clippy-debuginfo | May 21, 2021 | Apr 11, 2021 |
| Rocky_linux | — | Upgrade rustUpgrade clippyUpgrade clippy-debuginfoUpgrade rlsUpgrade rust-debugsourceUpgrade rust-std-staticUpgrade cargo-debuginfoUpgrade rust-debuginfoUpgrade rustfmt-debuginfoUpgrade rust-analysisUpgrade rust-docUpgrade rust-toolsetUpgrade cargoUpgrade rustfmtUpgrade rls-debuginfo | Mar 12, 2024 | Apr 11, 2021 |
| Ubuntu | — | Upgrade rustc | Nov 19, 2024 | Apr 11, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub