CVE-2020-36471 Data races in generator
The Rust generator crate fails to enforce Send bounds on yielding functions, potentially causing thread-safety issues in concurrent applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-36471?
CVE-2020-36471 is a medium-severity vulnerability in n/a, published on 8 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the generator crate before 0.7.0 for Rust. It does not ensure that a function (for yielding values) has Send bounds.
Which versions are affected by CVE-2020-36471?
3 open source packages ship an affected version, including generator. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
generator crates.io | All versions | 0.7.0 |
generator crates.io | All versions | 0.7.0 |
generator crates.io | From 0.0.0-0 | 0.7.0 |
Products include Generator Project Generator.
How do I fix CVE-2020-36471?
Upgrade generator to 0.7.0 or later.
Is CVE-2020-36471 being exploited?
There is no known exploitation of CVE-2020-36471 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2020-36471, GHSA-w3g5-2848-2v8r, RUSTSEC-2020-0151, UBUNTU-CVE-2020-36471.