​
DirectorySecurity Advisories
Sign In
Security Advisories

CGA-w6c5-59gw-jcw8

Published

Last updated

https://images.chainguard.dev/security/CGA-w6c5-59gw-jcw8
Package

zola

Latest Update
Fixed
Fixed Version

0.19.2-r1

Aliases
  • GHSA-74r5-g7vc-j2v2

Severity

6.2

Medium

CVSS V3

Summary

zerovec-derive incorrectly uses #[repr(packed)]

Description

The affected versions make unsafe memory accesses under the assumption that #[repr(packed)] has a guaranteed field order.

The Rust specification does not guarantee this, and https://github.com/rust-lang/rust/pull/125360 (1.80.0-beta) starts reordering fields of #[repr(packed)] structs, leading to illegal memory accesses.

The patched versions 0.9.7 and 0.10.3 use #[repr(C, packed)], which guarantees field order.

References

Updates


Safe Source for Open Sourceâ„¢
Media KitContact Us
© 2024 Chainguard. All Rights Reserved.
Private PolicyTerms of Use

Product

Chainguard Images