{"id":"GHSA-5j8w-r7g8-5472","aliases":["RUSTSEC-2022-0012"],"url":"https://o3.security/vulnerability/GHSA-5j8w-r7g8-5472","summary":"Arrow2 allows double free in `safe` code","details":"The struct `Ffi_ArrowArray` implements `#derive(Clone)` that is inconsistent with\nits custom implementation of `Drop`, resulting in a double free when cloned.\n\nCloning this struct in `safe` results in a segmentation fault, which is unsound.\n\nThis derive was removed from this struct. All users are advised to either:\n* bump the patch version of this crate (for versions `v0.7,v0.8,v0.9`), or\n* migrate to a more recent version of  the crate (when using `<0.7`).\n\nDoing so elimitates this vulnerability (code no longer compiles).\n","published":"2022-06-16T23:42:08Z","modified":"2023-11-08T04:15:47.037496Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"arrow2","fixedVersion":"0.7.1"},{"ecosystem":"crates.io","name":"arrow2","fixedVersion":"0.8.2"},{"ecosystem":"crates.io","name":"arrow2","fixedVersion":"0.9.2"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/jorgecarleitao/arrow2/issues/880"},{"type":"PACKAGE","url":"https://github.com/jorgecarleitao/arrow2"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2022-0012.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2023-11-08T04:15:47.037496Z"}}