{"answers":{"affected":"3 open source packages ship an affected version, including threadalone.","exploited":"There is no known exploitation of GHSA-w59h-378f-2frm in the wild and no public exploit code.","fix":"Upgrade threadalone to 0.2.1 or later.","what":"GHSA-w59h-378f-2frm is a vulnerability in threadalone, published on 7 Jan 2024."},"fix_prompt":"Check this codebase for GHSA-w59h-378f-2frm and fix it if it is affected.\n\nWhat it is: GHSA-w59h-378f-2frm is a vulnerability in threadalone, published on 7 Jan 2024. \nExploitation: There is no known exploitation of GHSA-w59h-378f-2frm in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- threadalone (crates.io): affected all versions; fixed in 0.2.1\n- threadalone (crates.io): affected all versions; fixed in 0.2.1\n- threadalone (crates.io): affected from 0.0.0-0; fixed in 0.2.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-w59h-378f-2frm/ (Markdown: https://insights.sbomify.com/GHSA-w59h-378f-2frm/index.md)","id":"GHSA-w59h-378f-2frm","markdown":"https://insights.sbomify.com/GHSA-w59h-378f-2frm/index.md","name":"GHSA-w59h-378f-2frm","record":{"aliases":["RUSTSEC-2024-0005"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution","denial_of_service"],"network_reachable":"unknown","non_default_config":false,"product_category":"Rust threadalone crate","requires_auth":"none","summary":"The threadalone crate may drop non-Send types on the wrong thread, causing undefined behavior and potential crashes or code execution.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Affected versions can run the `Drop` impl of a non-Send type on a different\nthread than it was created on.\n\nThe flaw occurs when a stderr write performed by the `threadalone` crate fails,\nfor example because stderr is redirected to a location on a filesystem that is\nfull, or because stderr is a pipe that has been closed by the reader.\n\nDropping a non-Send type on the wrong thread is unsound. If used with a type\nsuch as a pthread-based `MutexGuard`, [the consequence is undefined\nbehavior][mutexguard]. If used with `Rc`, there would be a data race on the\nreference count, which is likewise undefined behavior.\n\n[mutexguard]: https://github.com/rust-lang/rust/issues/23465#issuecomment-82730326","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Unsound sending of non-Send types across threads in threadalone","id":"GHSA-w59h-378f-2frm","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"race_condition","year":"2024"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["0.2.1"],"introduced":["0"],"last_affected":[],"package":"threadalone","purl":null,"source":"GHSA-w59h-378f-2frm"},{"ecosystem":"crates.io","fixed":["0.2.1"],"introduced":["0"],"last_affected":[],"package":"threadalone","purl":"pkg:cargo/threadalone","source":"GHSA-w59h-378f-2frm"},{"ecosystem":"crates.io","fixed":["0.2.1"],"introduced":["0.0.0-0"],"last_affected":[],"package":"threadalone","purl":"pkg:cargo/threadalone","source":"RUSTSEC-2024-0005"}],"products":null,"published":"2024-01-07","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"The threadalone crate may drop non-Send types on the wrong thread, causing undefined behavior and potential crashes or code execution.","url":"https://insights.sbomify.com/GHSA-w59h-378f-2frm/"}