{"id":"GHSA-ghc8-5cgm-5rpf","aliases":["RUSTSEC-2023-0057"],"url":"https://o3.security/vulnerability/GHSA-ghc8-5cgm-5rpf","summary":"Inventory fails to prohibit standard library access prior to initialization of Rust standard library runtime","details":"Affected versions allow arbitrary caller-provided code to execute before the lifetime of `main`.\n\nIf the caller-provided code accesses particular pieces of the standard library that require an initialized Rust runtime, such as `std::io` or `std::thread`, these may not behave as documented. Panics are likely; UB is possible.\n\nThe flaw was corrected by enforcing that only code written within the `inventory` crate, which is guaranteed not to access runtime-dependent parts of the standard library, runs before `main`. Caller-provided code is restricted to running at compile time.\n","published":"2023-09-11T20:43:17Z","modified":"2024-02-10T16:26:48.633370Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"inventory","fixedVersion":"0.2.0"}],"fix":{"url":"https://github.com/dtolnay/inventory/pull/43","label":"dtolnay/inventory#43"},"references":[{"type":"WEB","url":"https://github.com/dtolnay/inventory/pull/43"},{"type":"WEB","url":"https://github.com/dtolnay/inventory/commit/b853350a3800e38d2cb9950355b80bc8b8d3959c"},{"type":"PACKAGE","url":"https://github.com/dtolnay/inventory"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2023-0057.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-02-10T16:26:48.633370Z"}}