{"id":"GHSA-fjx5-qpf4-xjf2","aliases":["RUSTSEC-2023-0033"],"url":"https://o3.security/vulnerability/GHSA-fjx5-qpf4-xjf2","summary":"Parsing borsh messages with ZST which are not-copy/clone is unsound","details":"Affected versions of borsh cause undefined behavior when zero-sized-types (ZST) are parsed and the Copy/Clone traits are not implemented/derived. For instance if 1000 instances of a ZST are deserialized, and the ZST is not copy (this can be achieved through a singleton), then accessing/writing to deserialized data will cause a segmentation fault.\n\nThere is currently no way for borsh to read data without also providing a Rust type. Therefore, if you are not using ZST for serialization, then you are not affected by this issue. \n","published":"2023-04-17T16:32:26Z","modified":"2024-09-23T16:34:09Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"borsh","fixedVersion":"1.0.0-alpha.1"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/near/borsh-rs/issues/19"},{"type":"PACKAGE","url":"https://github.com/near/borsh-rs"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2023-0033.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-09-23T16:34:09Z"}}