CVE-2021-28878: Buffer Overflow
In the standard library in Rust before 1.52.0, the Zip implementation calls iteratorgetunchecked() more than once for the same index (under certain conditions) when nextback() and next() are used together. This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-28878?
CVE-2021-28878 is a vulnerability in the standard library in Rust before 1.52.0 that can lead to a memory safety violation.
How severe is CVE-2021-28878?
CVE-2021-28878 has a severity rating of 7.5, which is considered high.
Which software versions are affected by CVE-2021-28878?
Rust versions before 1.52.0 and Fedora versions 32, 33, and 34 are affected by CVE-2021-28878.
How can I fix CVE-2021-28878?
To fix CVE-2021-28878, update Rust to version 1.52.0 or later.
Where can I find more information about CVE-2021-28878?
You can find more information about CVE-2021-28878 in the references provided: https://github.com/rust-lang/rust/issues/82291, https://github.com/rust-lang/rust/pull/82292, https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CZ337CM4GFJLRDFVQCGC7J25V65JXOG5/