abscissa_core-0.5.2.crate: 3 vulnerabilities (highest severity is: 9.8)

[mend-for-github-com[bot]]

Vulnerable Library - abscissa_core-0.5.2.crate

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (abscissa_core version)	Remediation Available
CVE-2021-25900	High	9.8	smallvec-0.6.14.crate	Transitive	N/A*	❌
WS-2022-0242	High	8.8	owning_ref-0.4.1.crate	Transitive	N/A*	❌
CVE-2018-25023	High	7.5	smallvec-0.6.14.crate	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2021-25900

### Vulnerable Library - smallvec-0.6.14.crate

'Small vector' optimization: store up to a small number of items on the stack

Library home page: https://crates.io/api/v1/crates/smallvec/0.6.14/download

Dependency Hierarchy: - abscissa_core-0.5.2.crate (Root Library) - tracing-subscriber-0.1.6.crate - :x: **smallvec-0.6.14.crate** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.

Publish Date: 2021-01-26

URL: CVE-2021-25900

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-43w2-9j62-hq99

Release Date: 2021-01-26

Fix Resolution: 0.6.14;1.6.1

WS-2022-0242

### Vulnerable Library - owning_ref-0.4.1.crate

A library for creating references that carry their owner with them.

Library home page: https://crates.io/api/v1/crates/owning_ref/0.4.1/download

Dependency Hierarchy: - abscissa_core-0.5.2.crate (Root Library) - tracing-subscriber-0.1.6.crate - :x: **owning_ref-0.4.1.crate** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

All versions of owning_ref in Rust have multiple soundness issues that may result in a use-after free. The crate violates Rust's aliasing rules, which may cause miscompilations on recent compilers that emit the LLVM noalias attribute.

Publish Date: 2022-01-26

URL: WS-2022-0242

### CVSS 3 Score Details (8.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2018-25023

### Vulnerable Library - smallvec-0.6.14.crate

'Small vector' optimization: store up to a small number of items on the stack

Library home page: https://crates.io/api/v1/crates/smallvec/0.6.14/download

Dependency Hierarchy: - abscissa_core-0.5.2.crate (Root Library) - tracing-subscriber-0.1.6.crate - :x: **smallvec-0.6.14.crate** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

An issue was discovered in the smallvec crate before 0.6.13 for Rust. It can create an uninitialized value of any type, including a reference type.

Publish Date: 2021-12-27

URL: CVE-2018-25023

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://rustsec.org/advisories/RUSTSEC-2018-0018.html

Release Date: 2021-12-27

Fix Resolution: smallvec - 0.6.13