From 79b4d8e547c78b571f2e7b92ba47a023520b1abc Mon Sep 17 00:00:00 2001 From: Jorge Leitao Date: Sun, 7 Nov 2021 18:51:34 +0100 Subject: [PATCH] Add `flatbuffers` advisory for flatbuffers#6627 (#1093) --- crates/flatbuffers/RUSTSEC-0000-0000.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 crates/flatbuffers/RUSTSEC-0000-0000.md diff --git a/crates/flatbuffers/RUSTSEC-0000-0000.md b/crates/flatbuffers/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..d9bfead --- /dev/null +++ b/crates/flatbuffers/RUSTSEC-0000-0000.md @@ -0,0 +1,23 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "flatbuffers" +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" +date = "2021-10-31" +url = "https://github.com/google/flatbuffers/issues/6627" + +[versions] +patched = [] +``` + +# Generated code can read and write out of bounds in safe code + +Code generated by flatbuffers' compiler is `unsafe` but not marked as such. +See https://github.com/google/flatbuffers/issues/6627 for details. + +All users that use generated code by `flatbuffers` compiler are recommended to: +1. not expose flatbuffer generated code as part of their public APIs +2. audit their code and look for any usage of `follow`, `push`, or any method that uses them + (e.g. `self_follow`). +3. Carefuly go through the crates' documentation to understand which "safe" APIs are not + intended to be used.