GHSA-f95p-4cv5-8w8x linkme fails to ensure slice elements match the slice's declared type

Not scored Published
Exploited in the wild
Not known
Fix
Available

What is GHSA-f95p-4cv5-8w8x?

GHSA-f95p-4cv5-8w8x is a vulnerability in linkme, published on 5 Mar 2024.

Official description

Affected versions allow populating a DistributedSlice of T with elements of an arbitrary other type that coerces to T. For example, elements of type &&str could end up in a slice of type [&str], since &&str coerces to &str via a deref coercion.

The flaw was corrected by implementing typechecking for distributed slice elements in such a way that coercion no longer occurs. The element's type must be a subtype of the slice's declared element type.

Which versions are affected by GHSA-f95p-4cv5-8w8x?

3 open source packages ship an affected version, including linkme.

PackageAffectedFixed in
linkme crates.ioAll versions0.3.24
linkme crates.ioAll versions0.3.24
linkme crates.ioFrom 0.0.0-00.3.24

How do I fix GHSA-f95p-4cv5-8w8x?

Upgrade linkme to 0.3.24 or later.

Is GHSA-f95p-4cv5-8w8x being exploited?

There is no known exploitation of GHSA-f95p-4cv5-8w8x in the wild and no public exploit code.

Sources

Also known as RUSTSEC-2024-0407.

Is GHSA-f95p-4cv5-8w8x in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free