diff --git a/crates/conqueue/RUSTSEC-0000-0000.md b/crates/conqueue/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..76c544e --- /dev/null +++ b/crates/conqueue/RUSTSEC-0000-0000.md @@ -0,0 +1,20 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "conqueue" +date = "2020-11-24" +url = "https://github.com/longshorej/conqueue/issues/9" +categories = ["memory-corruption"] + +[versions] +patched = [">= 0.4.0"] +``` + +# QueueSender/QueueReceiver: Send/Sync impls need `T: Send` + +Affected versions of this crate unconditionally implemented `Send`/`Sync` for `QueueSender`, +allowing to send non-Send `T` to other threads by invoking `(&QueueSender).send()`. + +This fails to prevent users from creating data races by sending types like `Rc` or `Arc>` to other threads, which can lead to memory corruption. + +The flaw was corrected in commit 1e462c3 by imposing `T: Send` to both `Send`/`Sync` impls for `QueueSender`/`QueueReceiver`.