GHSA-2wq5-g96f-mv3v json
Ouch! allows a segmentation fault due to use of uninitialized memory
published 2y ago modified last yr. also RUSTSEC-2024-0374
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
When trying to decompress a file using "ouch", we can reach the function "ouch::archive::zip::convert_zip_date_time". In the function, there is a unsafe function, "transmute". Once the "transmute" function is called to convert the type of "month" object, the address of the object is changed to the uninitialized memory region. After that, when other function tries to dereference "month", segmentation fault occurs.
Patch / fix
- crates.io ouch 0.3.1, 0.3.2-0
Is GHSA-2wq5-g96f-mv3v in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | ouch | <0.3.1 >=0.0.0-0, <0.3.2-0 |
0.3.1 0.3.2-0 |
References
-
github.com
/ouch-org/ouch/issues/707
web, report
-
github.com
/ouch-org/ouch
package
-
rustsec.org
/advisories/RUSTSEC-2024-0374.html
web, advisory
-
crates.io
/crates/ouch
package
Sources
- GitHub Advisory GHSA-2wq5-g96f-mv3v
- OSV RUSTSEC-2024-0374
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.