CVE-2020-36437 Data race in conqueue
Unconditional Send and Sync implementations in the conqueue crate allow data races, potentially leading to memory corruption or crashes in Rust applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-36437?
CVE-2020-36437 is a high-severity vulnerability in n/a, published on 8 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the conqueue crate before 0.4.0 for Rust. There are unconditional implementations of Send and Sync for QueueSender<T>.
Weakness: CWE-362
Which versions are affected by CVE-2020-36437?
3 open source packages ship an affected version, including conqueue. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
conqueue crates.io | All versions | 0.4.0 |
conqueue crates.io | All versions | 0.4.0 |
conqueue crates.io | From 0.0.0-0 | 0.4.0 |
Products include Conqueue Project Conqueue.
How do I fix CVE-2020-36437?
Upgrade conqueue to 0.4.0 or later.
Is CVE-2020-36437 being exploited?
There is no known exploitation of CVE-2020-36437 in the wild and no public exploit code.
Sources
Also known as GHSA-368f-29c3-4f2r, RUSTSEC-2020-0117.