In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the same string.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rust-debugger-commonUpgrade rust-analysisUpgrade cargo-docUpgrade rustUpgrade rust-lldbUpgrade rust-std-staticUpgrade rustfmtUpgrade rust-srcUpgrade rust-gdbUpgrade rlsUpgrade rust-toolsetUpgrade rust-docUpgrade clippyUpgrade cargo | May 4, 2022 | Apr 11, 2021 |
| Centos_linux | — | Upgrade cargo-docUpgrade rust-analysisUpgrade rust-docUpgrade cargoUpgrade rust-std-staticUpgrade rustfmt-debuginfoUpgrade rust-debugger-commonUpgrade rustfmtUpgrade clippyUpgrade rustUpgrade rust-srcUpgrade rust-lldbUpgrade rust-debuginfoUpgrade rust-toolsetUpgrade rls-debuginfoUpgrade rust-gdbUpgrade rlsUpgrade cargo-debuginfoUpgrade clippy-debuginfoUpgrade rust-debugsource | Jun 1, 2021 | Apr 11, 2021 |
| Debian | — | Upgrade rustc | Jul 30, 2024 | Apr 11, 2021 |
| Oracle Solaris | — | Upgrade developer/rust/cargo to version 1.53.0-11.4.39.0.1.107.0 on Solaris 11.4Upgrade developer/rust/rustc to version 1.53.0-11.4.39.0.1.107.0 on Solaris 11.4 | Nov 17, 2021 | Apr 11, 2021 |
| Oracle_linux | — | Upgrade cargo-docUpgrade rust-std-staticUpgrade rust-analysisUpgrade rust-debugger-commonUpgrade rustfmtUpgrade clippyUpgrade rust-gdbUpgrade rust-toolsetUpgrade rust-lldbUpgrade rlsUpgrade rustUpgrade rust-srcUpgrade cargoUpgrade rust-doc | May 26, 2021 | Oct 28, 2020 |
| Redhat_linux | — | Upgrade rustfmt-debuginfoUpgrade cargo-docUpgrade rustUpgrade rust-debugger-commonUpgrade rust-debuginfoUpgrade rust-docUpgrade rust-analysisUpgrade rls-debuginfoUpgrade rust-std-staticUpgrade rust-srcUpgrade cargoUpgrade rustfmtUpgrade rust-lldbUpgrade rust-toolsetUpgrade clippy-debuginfoUpgrade cargo-debuginfoUpgrade rust-gdbUpgrade rust-debugsourceUpgrade rlsUpgrade clippy | May 21, 2021 | Apr 11, 2021 |
| Rocky_linux | — | Upgrade rls-debuginfoUpgrade cargoUpgrade rustfmt-debuginfoUpgrade rust-docUpgrade rustfmtUpgrade rust-toolsetUpgrade rust-analysisUpgrade rust-debuginfoUpgrade rlsUpgrade cargo-debuginfoUpgrade clippyUpgrade rustUpgrade rust-debugsourceUpgrade rust-std-staticUpgrade clippy-debuginfo | Mar 12, 2024 | Apr 11, 2021 |
| Ubuntu | — | Upgrade rustc | Nov 19, 2024 | Apr 11, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub