OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2026-01-09 21:19:36 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add flatbuffers advisory for flatbuffers#6627 (#1093)

Browse Source
This commit is contained in:
Jorge Leitao
2021-11-07 18:51:34 +01:00
committed by GitHub
parent f4a8973706
commit 79b4d8e547
1 changed files with 23 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
crates/flatbuffers/RUSTSEC-0000-0000.md Normal file
View File

@@ -0,0 +1,23 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "flatbuffers"
cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
date = "2021-10-31"
url = "https://github.com/google/flatbuffers/issues/6627"
[versions]
patched = []
```
# Generated code can read and write out of bounds in safe code
Code generated by flatbuffers' compiler is `unsafe` but not marked as such.
See https://github.com/google/flatbuffers/issues/6627 for details.
All users that use generated code by `flatbuffers` compiler are recommended to:
1. not expose flatbuffer generated code as part of their public APIs
2. audit their code and look for any usage of `follow`, `push`, or any method that uses them
(e.g. `self_follow`).
3. Carefuly go through the crates' documentation to understand which "safe" APIs are not
intended to be used.