What is GHSA-6p3c-v8vc-c244?

GHSA-6p3c-v8vc-c244 is a security advisory published by GitHub Security Advisories with Critical severity. The `total_size` function for partial read the length of any `FixVec` is incorrect in molecule.

Which CVE IDs does GHSA-6p3c-v8vc-c244 cover?

GHSA-6p3c-v8vc-c244 covers the following CVE IDs: CVE-2021-45697. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6p3c-v8vc-c244?

GHSA-6p3c-v8vc-c244 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-6p3c-v8vc-c244?

GHSA-6p3c-v8vc-c244 affects 1 product, including: rust/molecule:\u003c 0.7.2.

GHSA-6p3c-v8vc-c244CriticalCVSS 9.8

The `total_size` function for partial read the length of any `FixVec` is incorrect in molecule.

Vendor

GitHub Security Advisories

Published

January 6, 2022

Last Modified

June 13, 2023

🔗 CVE IDs covered (1)

CVE-2021-45697 →

📋 Description

Anyone who uses total_size(..) function to partial read the length of any FixVec will get an incorrect result, due to an incorrect implementation. This has been resolved in the 0.7.2 release.

🎯 Affected products1

rust/molecule:< 0.7.2

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2021-45697
https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/molecule/RUSTSEC-2021-0103.md
https://rustsec.org/advisories/RUSTSEC-2021-0103.html
https://github.com/nervosnetwork/molecule/pull/49
https://github.com/nervosnetwork/molecule/security/advisories/GHSA-82hm-vh7g-hrh9
https://github.com/advisories/GHSA-6p3c-v8vc-c244