GHSA-p7mj-xvxg-grff: `out_reference :Out::from_raw` Should Be `unsafe` Vulnerability

MODERATE
Share
Published
Advisory Summary

GHSA-p7mj-xvxg-grff is a MODERATE :out::from_raw` should be `unsafe` vulnerability (General Security Weakness) affecting `out_reference libraries in the crates.io ecosystem. The issue involves :out::from_raw` should be `unsafe`. Remediation is available by upgrading affected packages to version 0.2.0.

GHSA-p7mj-xvxg-grff at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-p7mj-xvxg-grff
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product `out_reference
Package Ecosystem crates.io
Published Date
Last Updated

How to Fix GHSA-p7mj-xvxg-grff

To remediate this vulnerability, upgrade all affected `out_reference dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

out-reference fixed: 0.2.0 
Upgrade out-reference to 0.2.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for out-reference

How to Check if You Are Affected

To determine whether your application is affected by GHSA-p7mj-xvxg-grff, inspect your project dependencies for `out_reference:

inspect dependencies for out-reference

Analyze the terminal output to locate any version of `out_reference in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.2.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In `out_reference, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

`Out::from_raw` in affected versions allows writing a value to invalid memory address without requiring `unsafe`. The soundness issue has been addressed by making `Out::from_raw` an unsafe function.

GHSA-p7mj-xvxg-grff Affected `out_reference Versions

1 component(s)
Fixed Versions:
0.2.0
Product / Package Ecosystem Affected Versions Fixed Version
out-reference
 crates.io
≥ 0.1.0
< 0.2.0
0.2.0

References

`out_reference Source Repository REPOSITORY
https://github.com/RustyYato/out-ref/issues/1
rustsec.org/advisories/rustsec-... WEB
https://rustsec.org/advisories/RUSTSEC-2021-0152.html

Frequently Asked Questions

What is GHSA-p7mj-xvxg-grff?
GHSA-p7mj-xvxg-grff is a security vulnerability in `out_reference involving :Out::from_raw` should be `unsafe` under General Security Weakness.
Which `out_reference versions are affected?
Affected versions include releases prior to 0.2.0 across affected packages: out-reference.
What version fixes GHSA-p7mj-xvxg-grff?
Upgrading to 0.2.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is out-reference affected?
Yes, out-reference is affected in releases prior to 0.2.0. Upgrade your dependency to 0.2.0 or later.
What CWE is associated with GHSA-p7mj-xvxg-grff?
GHSA-p7mj-xvxg-grff is classified under General Security Weakness.
How can I check crates.io dependencies for GHSA-p7mj-xvxg-grff?
Run the dependency tree command: 'inspect dependencies for out-reference'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-p7mj-xvxg-grff",
  "modified" : "2023-03-13T20:49:24Z",
  "published" : "2023-03-13T20:49:24Z",
  "aliases" : [ ],
  "summary" : "`out_reference::Out::from_raw` should be `unsafe`",
  "details" : "`Out::from_raw` in affected versions allows writing a value to invalid memory address without requiring `unsafe`.\n\nThe soundness issue has been addressed by making `Out::from_raw` an unsafe function.\n",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "out-reference"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.1.0"
      }, {
        "fixed" : "0.2.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/RustyYato/out-ref/issues/1"
  }, {
    "type" : "WEB",
    "url" : "https://rustsec.org/advisories/RUSTSEC-2021-0152.html"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-03-13T20:49:24Z",
    "nvd_published_at" : null
  }
}