OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2025-12-29 15:56:07 +01:00
Code Issues Packages Projects Releases Wiki Activity

add hyper advisory (#1232)

Browse Source
This commit is contained in:
Ralf Jung
2022-05-10 20:42:51 +02:00
committed by GitHub
parent e78650dfe3
commit 6b7b129aef
1 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
crates/hyper/RUSTSEC-0000-0000.md Normal file
View File

@@ -0,0 +1,18 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "hyper"
date = "2022-05-10"
informational = "unsound"
url = "https://github.com/hyperium/hyper/pull/2545"
[versions]
patched = [">= 0.4.12"]
```
# Parser creates invalid uninitialized value
Affected versions of this crate called `mem::uninitialized()` in the HTTP1 parser to create values of type `httparse::Header` (from the `httparse` crate).
This is unsound, since `Header` contains references and thus must be non-null.
The flaw was corrected by avoiding the use of `mem::uninitialized()`, using `MaybeUninit` instead.