GHSA-c2hm-mjxv-89r4 json
Multiple soundness issues in lexical
published 3y ago modified 9mo ago also RUSTSEC-2023-0055
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
`lexical` contains multiple soundness issues:
1. [Bytes::read() allows creating instances of types with invalid bit patterns](https://github.com/Alexhuszagh/rust-lexical/issues/102) 1. [BytesIter::read() advances iterators out of bounds](https://github.com/Alexhuszagh/rust-lexical/issues/101) 1. [The `BytesIter` trait has safety invariants but is public and not marked `unsafe`](https://github.com/Alexhuszagh/rust-lexical/issues/104) 1. [`write_float()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/95) 1. [`radix()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/126)
The crate also has some correctness issues.
## Alternatives
For quickly parsing floating-point numbers third-party crates are no longer needed. A fast float parsing algorithm by the author of `lexical` has been [merged](https://github.com/rust-lang/rust/pull/86761) into libcore.
For quickly parsing integers, consider `atoi` and `btoi` crates (100% safe code). `atoi_radix10` provides even faster parsing, but only with `-C target-cpu=native`, and at the cost of some `unsafe`.
For formatting integers in a `#[no_std]` context consider the [`numtoa`](https://crates.io/crates/numtoa) crate.
For working with big numbers consider `num-bigint` and `num-traits`.
Patch / fix
- crates.io lexical 7.0.0
Is GHSA-c2hm-mjxv-89r4 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | lexical | <7.0.0 >=0.0.0-0, <7.0.0 |
7.0.0 |
References
-
github.com
/Alexhuszagh/rust-lexical
package
-
rustsec.org
/advisories/RUSTSEC-2023-0055.html
web, advisory
-
crates.io
/crates/lexical
package
-
github.com
/Alexhuszagh/rust-lexical/issues/102
report
-
github.com
/Alexhuszagh/rust-lexical/issues/101
report
-
github.com
/Alexhuszagh/rust-lexical/issues/95
report
-
github.com
/Alexhuszagh/rust-lexical/issues/104
report
-
github.com
/Alexhuszagh/rust-lexical/issues/126
report
Sources
- GitHub Advisory GHSA-c2hm-mjxv-89r4
- OSV RUSTSEC-2023-0055
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.