hello-world.rs icon indicating copy to clipboard operation
hello-world.rs copied to clipboard

Published 20 hours ago • verified publisher icon mTvare6

CVE-2021-25902 (High) detected in glsl-layout-0.3.2.crate

Open mend-bolt-for-github[bot] opened this issue 4 years ago • 0 comments

CVE-2021-25902 - High Severity Vulnerability

Vulnerable Library - glsl-layout-0.3.2.crate

Provides data types and traits to build structures ready to upload into UBO.

Library home page: https://crates.io/api/v1/crates/glsl-layout/0.3.2/download

Dependency Hierarchy:

  • amethyst-0.15.3.crate (Root Library)
    • amethyst_ui-0.15.3.crate
      • :x: glsl-layout-0.3.2.crate (Vulnerable Library)

Found in HEAD commit: a5a175063bd51fcbbce0eaba88d1b9b6ad315911

Found in base branch: master

Vulnerability Details

An issue was discovered in the glsl-layout crate before 0.4.0 for Rust. When a panic occurs, map_array can perform a double drop.

Publish Date: 2021-01-26

URL: CVE-2021-25902

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High
For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://rustsec.org/advisories/RUSTSEC-2021-0005.html

Release Date: 2021-01-26

Fix Resolution: glsl-layout - 0.4.0

Step up your Open Source Security Game with Mend here

mend-bolt-for-github[bot] avatar Sep 27 '21 15:09 mend-bolt-for-github[bot]