In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the same string.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rust-lldbUpgrade rust-srcUpgrade rustUpgrade rust-std-staticUpgrade rustfmtUpgrade rust-analysisUpgrade rust-debugger-commonUpgrade cargo-docUpgrade rust-docUpgrade clippyUpgrade rust-gdbUpgrade rlsUpgrade rust-toolsetUpgrade cargo | May 4, 2022 | Apr 11, 2021 |
| Centos_linux | — | Upgrade rust-debugsourceUpgrade clippy-debuginfoUpgrade rlsUpgrade rust-toolsetUpgrade rust-lldbUpgrade cargo-debuginfoUpgrade rls-debuginfoUpgrade rust-debuginfoUpgrade rust-gdbUpgrade rustfmt-debuginfoUpgrade rustUpgrade cargo-docUpgrade cargoUpgrade rustfmtUpgrade rust-analysisUpgrade rust-debugger-commonUpgrade rust-docUpgrade rust-std-staticUpgrade rust-srcUpgrade clippy | Jun 1, 2021 | Apr 11, 2021 |
| Debian | — | Upgrade rustc | Jul 30, 2024 | Apr 11, 2021 |
| Oracle Solaris | — | Upgrade developer/rust/cargo to version 1.53.0-11.4.39.0.1.107.0 on Solaris 11.4Upgrade developer/rust/rustc to version 1.53.0-11.4.39.0.1.107.0 on Solaris 11.4 | Nov 17, 2021 | Apr 11, 2021 |
| Oracle_linux | — | Upgrade rust-std-staticUpgrade rust-debugger-commonUpgrade cargo-docUpgrade rust-analysisUpgrade cargoUpgrade rust-srcUpgrade clippyUpgrade rust-gdbUpgrade rustUpgrade rust-lldbUpgrade rust-toolsetUpgrade rlsUpgrade rustfmtUpgrade rust-doc | May 26, 2021 | Oct 28, 2020 |
| Redhat_linux | — | Upgrade rust-debugsourceUpgrade clippyUpgrade rlsUpgrade clippy-debuginfoUpgrade cargo-debuginfoUpgrade rust-toolsetUpgrade rust-gdbUpgrade rust-srcUpgrade rust-std-staticUpgrade rust-debuginfoUpgrade rls-debuginfoUpgrade rustfmt-debuginfoUpgrade rust-analysisUpgrade rust-debugger-commonUpgrade cargo-docUpgrade rustUpgrade rust-docUpgrade rust-lldbUpgrade rustfmtUpgrade cargo | May 21, 2021 | Apr 11, 2021 |
| Rocky_linux | — | Upgrade rustUpgrade rlsUpgrade rust-std-staticUpgrade cargo-debuginfoUpgrade rust-debugsourceUpgrade clippyUpgrade clippy-debuginfoUpgrade rustfmtUpgrade rust-docUpgrade cargoUpgrade rust-toolsetUpgrade rustfmt-debuginfoUpgrade rust-debuginfoUpgrade rls-debuginfoUpgrade rust-analysis | Mar 12, 2024 | Apr 11, 2021 |
| Ubuntu | — | Upgrade rustc | Nov 19, 2024 | Apr 11, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub