{"id":"GHSA-x4mq-m75f-mx8m","aliases":["RUSTSEC-2022-0008"],"url":"https://o3.security/vulnerability/GHSA-x4mq-m75f-mx8m","summary":"Delegate functions are missing `Send` bound","details":"Affected versions of this crate did not require event handlers to have `Send` bound despite there being no guarantee of them being called on any particular thread, which can potentially lead to data races and undefined behavior.\n\nThe flaw was corrected in commit [afe3252](https://github.com/microsoft/windows-rs/commit/afe32525c22209aa8f632a0f4ad607863b51796a) by adding `Send` bounds.","published":"2022-06-17T00:30:33Z","modified":"2023-11-08T04:24:10.132668Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"windows","fixedVersion":"0.32.0"}],"fix":{"url":"https://github.com/microsoft/windows-rs/commit/afe32525c22209aa8f632a0f4ad607863b51796a","label":"microsoft/windows-rs@afe3252"},"references":[{"type":"WEB","url":"https://github.com/microsoft/windows-rs/issues/1409"},{"type":"WEB","url":"https://github.com/microsoft/windows-rs/commit/afe32525c22209aa8f632a0f4ad607863b51796a"},{"type":"PACKAGE","url":"https://github.com/microsoft/windows-rs"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2022-0008.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2023-11-08T04:24:10.132668Z"}}