In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the same string.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rust-std-staticUpgrade rustUpgrade cargo-docUpgrade rust-lldbUpgrade rustfmtUpgrade rust-srcUpgrade rust-debugger-commonUpgrade rust-analysisUpgrade rust-toolsetUpgrade clippyUpgrade rust-docUpgrade rlsUpgrade cargoUpgrade rust-gdb | May 4, 2022 | Apr 11, 2021 |
| Centos_linux | — | Upgrade rust-debugsourceUpgrade rls-debuginfoUpgrade rust-toolsetUpgrade rlsUpgrade clippy-debuginfoUpgrade rust-debuginfoUpgrade rust-lldbUpgrade rust-gdbUpgrade cargo-debuginfoUpgrade rust-std-staticUpgrade rustUpgrade rust-srcUpgrade rust-analysisUpgrade rustfmtUpgrade rust-debugger-commonUpgrade cargoUpgrade rust-docUpgrade rustfmt-debuginfoUpgrade clippyUpgrade cargo-doc | Jun 1, 2021 | Apr 11, 2021 |
| Debian | — | Upgrade rustc | Jul 30, 2024 | Apr 11, 2021 |
| Oracle Solaris | — | Upgrade developer/rust/cargo to version 1.53.0-11.4.39.0.1.107.0 on Solaris 11.4Upgrade developer/rust/rustc to version 1.53.0-11.4.39.0.1.107.0 on Solaris 11.4 | Nov 17, 2021 | Apr 11, 2021 |
| Oracle_linux | — | Upgrade rust-analysisUpgrade rust-std-staticUpgrade cargo-docUpgrade rust-debugger-commonUpgrade rlsUpgrade rust-docUpgrade cargoUpgrade rust-srcUpgrade rust-gdbUpgrade rustUpgrade clippyUpgrade rustfmtUpgrade rust-toolsetUpgrade rust-lldb | May 26, 2021 | Oct 28, 2020 |
| Redhat_linux | — | Upgrade rust-analysisUpgrade rust-std-staticUpgrade rust-docUpgrade cargo-docUpgrade rust-lldbUpgrade rustUpgrade rls-debuginfoUpgrade rust-debugger-commonUpgrade rust-debuginfoUpgrade rustfmtUpgrade rustfmt-debuginfoUpgrade cargoUpgrade rust-srcUpgrade cargo-debuginfoUpgrade rust-debugsourceUpgrade rust-gdbUpgrade clippy-debuginfoUpgrade rust-toolsetUpgrade clippyUpgrade rls | May 21, 2021 | Apr 11, 2021 |
| Rocky_linux | — | Upgrade cargo-debuginfoUpgrade rust-debugsourceUpgrade rust-std-staticUpgrade rlsUpgrade clippyUpgrade clippy-debuginfoUpgrade rustUpgrade rustfmtUpgrade cargoUpgrade rustfmt-debuginfoUpgrade rls-debuginfoUpgrade rust-docUpgrade rust-toolsetUpgrade rust-analysisUpgrade rust-debuginfo | Mar 12, 2024 | Apr 11, 2021 |
| Ubuntu | — | Upgrade rustc | Nov 19, 2024 | Apr 11, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub