CVE-2020-36449 Command injection in kekbit
The kekbit Rust crate incorrectly implements Send for ShmWriter, potentially allowing unsafe concurrent access and memory corruption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-36449?
CVE-2020-36449 is a high-severity vulnerability in n/a, published on 8 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the kekbit crate before 0.3.4 for Rust. For ShmWriter<H>, Send is implemented without requiring H: Send.
Weakness: CWE-77
Which versions are affected by CVE-2020-36449?
3 open source packages ship an affected version, including kekbit. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kekbit crates.io | All versions | 0.3.4 |
kekbit crates.io | All versions | 0.3.4 |
kekbit crates.io | From 0.0.0-0 | 0.3.4 |
Products include Kekbit Project Kekbit.
How do I fix CVE-2020-36449?
Upgrade kekbit to 0.3.4 or later.
Is CVE-2020-36449 being exploited?
There is no known exploitation of CVE-2020-36449 in the wild and no public exploit code.
Sources
Also known as GHSA-g83m-67wh-whpw, RUSTSEC-2020-0129.