In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the same string.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rust-lldbUpgrade rust-analysisUpgrade rust-std-staticUpgrade rustfmtUpgrade rust-srcUpgrade rustUpgrade cargo-docUpgrade rust-debugger-commonUpgrade rust-gdbUpgrade rust-toolsetUpgrade rust-docUpgrade cargoUpgrade rlsUpgrade clippy | May 4, 2022 | Apr 11, 2021 |
| Centos_linux | — | Upgrade rlsUpgrade rls-debuginfoUpgrade rust-toolsetUpgrade rust-lldbUpgrade cargo-debuginfoUpgrade clippy-debuginfoUpgrade rust-debugsourceUpgrade rust-debuginfoUpgrade rust-gdbUpgrade clippyUpgrade rust-srcUpgrade rust-std-staticUpgrade cargo-docUpgrade rust-debugger-commonUpgrade rust-docUpgrade rustfmt-debuginfoUpgrade rustUpgrade rustfmtUpgrade rust-analysisUpgrade cargo | Jun 1, 2021 | Apr 11, 2021 |
| Debian | — | Upgrade rustc | Jul 30, 2024 | Apr 11, 2021 |
| Oracle Solaris | — | Upgrade developer/rust/cargo to version 1.53.0-11.4.39.0.1.107.0 on Solaris 11.4Upgrade developer/rust/rustc to version 1.53.0-11.4.39.0.1.107.0 on Solaris 11.4 | Nov 17, 2021 | Apr 11, 2021 |
| Oracle_linux | — | Upgrade cargo-docUpgrade rust-std-staticUpgrade rust-debugger-commonUpgrade rust-analysisUpgrade rust-lldbUpgrade rust-toolsetUpgrade cargoUpgrade rlsUpgrade rust-gdbUpgrade rustUpgrade clippyUpgrade rust-srcUpgrade rustfmtUpgrade rust-doc | May 26, 2021 | Oct 28, 2020 |
| Redhat_linux | — | Upgrade rust-lldbUpgrade rustfmtUpgrade cargoUpgrade rls-debuginfoUpgrade rust-debuginfoUpgrade rust-srcUpgrade rust-std-staticUpgrade rust-debugger-commonUpgrade rustfmt-debuginfoUpgrade cargo-docUpgrade rustUpgrade rust-docUpgrade rust-analysisUpgrade rust-toolsetUpgrade clippyUpgrade rust-gdbUpgrade rust-debugsourceUpgrade clippy-debuginfoUpgrade cargo-debuginfoUpgrade rls | May 21, 2021 | Apr 11, 2021 |
| Rocky_linux | — | Upgrade rust-analysisUpgrade rustfmtUpgrade rustfmt-debuginfoUpgrade cargoUpgrade rls-debuginfoUpgrade rust-docUpgrade rust-debuginfoUpgrade rust-toolsetUpgrade cargo-debuginfoUpgrade rust-debugsourceUpgrade rlsUpgrade rust-std-staticUpgrade clippy-debuginfoUpgrade clippyUpgrade rust | Mar 12, 2024 | Apr 11, 2021 |
| Ubuntu | — | Upgrade rustc | Nov 19, 2024 | Apr 11, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub