In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the same string.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rust-lldbUpgrade cargo-docUpgrade rustUpgrade rust-analysisUpgrade rust-debugger-commonUpgrade rustfmtUpgrade rust-srcUpgrade rust-std-staticUpgrade clippyUpgrade rust-gdbUpgrade rlsUpgrade rust-toolsetUpgrade rust-docUpgrade cargo | May 4, 2022 | Apr 11, 2021 |
| Centos_linux | — | Upgrade rust-docUpgrade rust-std-staticUpgrade clippyUpgrade rust-srcUpgrade cargo-docUpgrade rustUpgrade rustfmt-debuginfoUpgrade cargoUpgrade rust-analysisUpgrade rust-debugger-commonUpgrade rustfmtUpgrade rust-debugsourceUpgrade cargo-debuginfoUpgrade rust-gdbUpgrade rust-debuginfoUpgrade rust-lldbUpgrade rls-debuginfoUpgrade rlsUpgrade clippy-debuginfoUpgrade rust-toolset | Jun 1, 2021 | Apr 11, 2021 |
| Debian | — | Upgrade rustc | Jul 30, 2024 | Apr 11, 2021 |
| Oracle Solaris | — | Upgrade developer/rust/cargo to version 1.53.0-11.4.39.0.1.107.0 on Solaris 11.4Upgrade developer/rust/rustc to version 1.53.0-11.4.39.0.1.107.0 on Solaris 11.4 | Nov 17, 2021 | Apr 11, 2021 |
| Oracle_linux | — | Upgrade rust-std-staticUpgrade rust-analysisUpgrade cargo-docUpgrade rust-debugger-commonUpgrade rust-toolsetUpgrade rust-lldbUpgrade rustfmtUpgrade rust-docUpgrade rustUpgrade rust-gdbUpgrade clippyUpgrade rlsUpgrade rust-srcUpgrade cargo | May 26, 2021 | Oct 28, 2020 |
| Redhat_linux | — | Upgrade cargo-debuginfoUpgrade clippyUpgrade clippy-debuginfoUpgrade rust-debugsourceUpgrade rust-gdbUpgrade rlsUpgrade rust-toolsetUpgrade rust-docUpgrade rust-debugger-commonUpgrade rust-debuginfoUpgrade rustUpgrade rust-analysisUpgrade cargo-docUpgrade cargoUpgrade rust-srcUpgrade rust-std-staticUpgrade rls-debuginfoUpgrade rust-lldbUpgrade rustfmt-debuginfoUpgrade rustfmt | May 21, 2021 | Apr 11, 2021 |
| Rocky_linux | — | Upgrade rust-debuginfoUpgrade rust-toolsetUpgrade rustfmt-debuginfoUpgrade cargoUpgrade rustfmtUpgrade rust-docUpgrade rls-debuginfoUpgrade rust-analysisUpgrade rustUpgrade rust-std-staticUpgrade rlsUpgrade cargo-debuginfoUpgrade clippy-debuginfoUpgrade clippyUpgrade rust-debugsource | Mar 12, 2024 | Apr 11, 2021 |
| Ubuntu | — | Upgrade rustc | Nov 19, 2024 | Apr 11, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub