Open mend-bolt-for-github[bot] opened 3 years ago
An event-driven, non-blocking I/O platform for writing asynchronous I/O backed applications.
Library home page: https://crates.io/api/v1/crates/tokio/1.0.1/download
Path to dependency file: /third_party/rust_crates/vendor/crossterm/Cargo.toml
Path to vulnerable library: /third_party/rust_crates/vendor/crossterm/Cargo.toml
Dependency Hierarchy: - :x: **tokio-1.0.1.crate** (Vulnerable Library)
Found in base branch: master
An issue was discovered in the tokio crate before 1.8.1 for Rust. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread. Mend Note: Converted from WS-2021-0178, on 2021-08-09.
Publish Date: 2021-08-08
URL: CVE-2021-38191
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
Type: Upgrade version
Origin: https://rustsec.org/advisories/RUSTSEC-2021-0072.html
Release Date: 2021-08-08
Fix Resolution: tokio - 1.5.1,1.6.3,1.7.2, 1.8.1
Step up your Open Source Security Game with Mend here
CVE-2021-38191 - Medium Severity Vulnerability
An event-driven, non-blocking I/O platform for writing asynchronous I/O backed applications.
Library home page: https://crates.io/api/v1/crates/tokio/1.0.1/download
Path to dependency file: /third_party/rust_crates/vendor/crossterm/Cargo.toml
Path to vulnerable library: /third_party/rust_crates/vendor/crossterm/Cargo.toml
Dependency Hierarchy: - :x: **tokio-1.0.1.crate** (Vulnerable Library)
Found in base branch: master
An issue was discovered in the tokio crate before 1.8.1 for Rust. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread. Mend Note: Converted from WS-2021-0178, on 2021-08-09.
Publish Date: 2021-08-08
URL: CVE-2021-38191
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://rustsec.org/advisories/RUSTSEC-2021-0072.html
Release Date: 2021-08-08
Fix Resolution: tokio - 1.5.1,1.6.3,1.7.2, 1.8.1
Step up your Open Source Security Game with Mend here