What is GHSA-xwxc-j97j-84gf?

GHSA-xwxc-j97j-84gf is a security advisory published by GitHub Security Advisories with High severity. Race condition in Parc

Why does GHSA-xwxc-j97j-84gf have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-xwxc-j97j-84gf?

GHSA-xwxc-j97j-84gf has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

Which products are affected by GHSA-xwxc-j97j-84gf?

GHSA-xwxc-j97j-84gf affects 1 product, including: rust/parc:\u003c= 1.0.1.

GHSA-xwxc-j97j-84gfHighCVSS 8.1Disclosed before NVD

Race condition in Parc

Vendor

GitHub Security Advisories

Published

August 25, 2021

Last Modified

June 13, 2023

📋 Description

In the affected versions of this crate, LockWeak<T> unconditionally implemented Send with no trait bounds on T. LockWeak<T> doesn't own T and only provides &T. This allows concurrent access to a non-Sync T, which can cause undefined behavior like data races.

🎯 Affected products1

rust/parc:<= 1.0.1

🔗 References (3)

https://github.com/hyyking/rustracts/pull/6
https://rustsec.org/advisories/RUSTSEC-2020-0134.html
https://github.com/advisories/GHSA-xwxc-j97j-84gf