Vulnerability-Lookup

rustsec-2021-0103

Vulnerability from osv_rustsec

Published

2021-07-30 12:00

Modified

2023-06-13 13:10

Summary

Partial read is incorrect in molecule

Details

Anyone who uses total_size(..) function to partial read the length of any FixVec will get an incorrect result, due to an incorrect implementation. This has been resolved in the 0.7.2 release.

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "categories": [],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "molecule",
        "purl": "pkg:cargo/molecule"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.7.2"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "CVE-2021-45697",
    "GHSA-6p3c-v8vc-c244",
    "GHSA-82hm-vh7g-hrh9"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "Anyone who uses total_size(..) function to partial read the length of any FixVec will get an incorrect result, due to an incorrect implementation. This has been resolved in the 0.7.2 release.",
  "id": "RUSTSEC-2021-0103",
  "modified": "2023-06-13T13:10:24Z",
  "published": "2021-07-30T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/molecule"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2021-0103.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/nervosnetwork/molecule/security/advisories/GHSA-82hm-vh7g-hrh9"
    }
  ],
  "related": [],
  "severity": [],
  "summary": " Partial read is incorrect in molecule"
}

CVE-2021-45697 (GCVE-0-2021-45697)

Vulnerability from cvelistv5 – Published: 2021-12-26 21:49 – Updated: 2024-08-04 04:47

Summary

An issue was discovered in the molecule crate before 0.7.2 for Rust. A FixVec partial read has an incorrect result.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://rustsec.org/advisories/RUSTSEC-2021-0103.html	x_refsource_MISC
	https://raw.githubusercontent.com/rustsec/advisor…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T04:47:01.796Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://rustsec.org/advisories/RUSTSEC-2021-0103.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/molecule/RUSTSEC-2021-0103.md"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in the molecule crate before 0.7.2 for Rust. A FixVec partial read has an incorrect result."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-26T21:49:49",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://rustsec.org/advisories/RUSTSEC-2021-0103.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/molecule/RUSTSEC-2021-0103.md"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-45697",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in the molecule crate before 0.7.2 for Rust. A FixVec partial read has an incorrect result."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://rustsec.org/advisories/RUSTSEC-2021-0103.html",
              "refsource": "MISC",
              "url": "https://rustsec.org/advisories/RUSTSEC-2021-0103.html"
            },
            {
              "name": "https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/molecule/RUSTSEC-2021-0103.md",
              "refsource": "MISC",
              "url": "https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/molecule/RUSTSEC-2021-0103.md"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-45697",
    "datePublished": "2021-12-26T21:49:49",
    "dateReserved": "2021-12-26T00:00:00",
    "dateUpdated": "2024-08-04T04:47:01.796Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GHSA-82HM-VH7G-HRH9

Vulnerability from github – Published: 2021-08-25 21:01 – Updated: 2021-09-09 17:55

Summary

Partial read is incorrect in molecule

Details

Impact

Anyone who uses total_size(..) function to partial read the length of any FixVec will get an incorrect result, due to an incorrect implementation. This has been resolved in the 0.7.2 release.

Workarounds

If you already have the whole FixVec A, you can use A.as_slice().len() to get the total size of the FixVec.

For more information

If you have any questions or comments about this advisory:

Open an issue to ask use directly.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "molecule"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-02T18:10:49Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nAnyone who uses `total_size(..)` function to partial read the length of any `FixVec` will get an incorrect result, due to an incorrect implementation. This has been resolved in the 0.7.2 release.\n\n### Workarounds\n\nIf you already have the whole `FixVec` `A`, you can use `A.as_slice().len()` to get the total size of the `FixVec`.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- [Open an issue to ask use directly](https://github.com/nervosnetwork/molecule/issues/new).",
  "id": "GHSA-82hm-vh7g-hrh9",
  "modified": "2021-09-09T17:55:10Z",
  "published": "2021-08-25T21:01:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nervosnetwork/molecule/security/advisories/GHSA-82hm-vh7g-hrh9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nervosnetwork/molecule/pull/49"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nervosnetwork/molecule"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2021-0103.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Partial read is incorrect in molecule"
}

GHSA-6P3C-V8VC-C244

Vulnerability from github – Published: 2022-01-06 22:10 – Updated: 2023-06-13 18:33

Summary

The `total_size` function for partial read the length of any `FixVec` is incorrect in molecule.

Details

Anyone who uses total_size(..) function to partial read the length of any FixVec will get an incorrect result, due to an incorrect implementation. This has been resolved in the 0.7.2 release.

Severity ?

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "molecule"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-45697"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-06T14:29:54Z",
    "nvd_published_at": "2021-12-27T00:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Anyone who uses total_size(..) function to partial read the length of any FixVec will get an incorrect result, due to an incorrect implementation. This has been resolved in the 0.7.2 release.",
  "id": "GHSA-6p3c-v8vc-c244",
  "modified": "2023-06-13T18:33:17Z",
  "published": "2022-01-06T22:10:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nervosnetwork/molecule/security/advisories/GHSA-82hm-vh7g-hrh9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45697"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nervosnetwork/molecule/pull/49"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nervosnetwork/molecule"
    },
    {
      "type": "WEB",
      "url": "https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/molecule/RUSTSEC-2021-0103.md"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2021-0103.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "The `total_size` function for partial read the length of any `FixVec` is incorrect in molecule."
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

rustsec-2021-0103

Vulnerability from osv_rustsec

CVE-2021-45697 (GCVE-0-2021-45697)

GHSA-82HM-VH7G-HRH9

Impact

Workarounds

For more information

GHSA-6P3C-V8VC-C244

Tags

Sightings

Nomenclature