CVE-2020-36220 Data race in va-ts
A missing Send bound in the va-ts crate allows data races leading to memory corruption, potentially enabling code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-36220?
CVE-2020-36220 is a medium-severity vulnerability in n/a, published on 22 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the va-ts crate before 0.0.4 for Rust. Because Demuxer<T> omits a required T: Send bound, a data race and memory corruption can occur.
Which versions are affected by CVE-2020-36220?
3 open source packages ship an affected version, including va-ts. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
va-ts crates.io | All versions | 0.0.4 |
va-ts crates.io | All versions | 0.0.4 |
va-ts crates.io | From 0.0.0-0 | 0.0.4 |
Products include Va-Ts Project Va-Ts.
How do I fix CVE-2020-36220?
Upgrade va-ts to 0.0.4 or later.
Is CVE-2020-36220 being exploited?
There is no known exploitation of CVE-2020-36220 in the wild and no public exploit code.
Sources
Also known as GHSA-3hj2-hh36-hv9v, RUSTSEC-2020-0114.