CVE-2021-26308 Uninitialized buffer use in marc
A user-provided Read implementation in the marc crate can access old contents of newly allocated memory, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-26308?
CVE-2021-26308 is a high-severity vulnerability in n/a, published on 29 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the marc crate before 2.0.0 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated memory, violating soundness.
Which versions are affected by CVE-2021-26308?
3 open source packages ship an affected version, including marc. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
marc crates.io | All versions | 2.0.0 |
marc crates.io | All versions | 2.0.0 |
marc crates.io | From 0.0.0-0 | 2.0.0 |
Products include Marc Project Marc.
How do I fix CVE-2021-26308?
Upgrade marc to 2.0.0 or later.
Is CVE-2021-26308 being exploited?
There is no known exploitation of CVE-2021-26308 in the wild and no public exploit code.
Sources
Also known as GHSA-3mf3-2gv9-h39j, RUSTSEC-2021-0014.