Vulnerability RUSTSEC-2022-0022
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
4 years ago
May 10, 2022 at 12:00 PM UTC
Parser creates invalid uninitialized value
0.0.1 - 0.12.36 and 0.13.0 - 0.14.11
0.0.1 - 0.12.36 and 0.13.0 - 0.14.11
Summary
Parser creates invalid uninitialized value
Details
Affected versions of this crate called mem::uninitialized() in the HTTP1 parser to create values of type httparse::Header (from the httparse crate). This is unsound, since Header contains references and thus must be non-null.
The flaw was corrected by avoiding the use of mem::uninitialized(), using MaybeUninit instead.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
4 years ago
Parser creates invalid uninitialized value
0.0.1 - 0.12.36 and 0.13.0 - 0.14.11 GHSA-f67m-9j94-qv9j
0.0.1 - 0.12.36 and 0.13.0 - 0.14.11 GHSA-f67m-9j94-qv9j
Medium Risk
5 years ago
HTTP Request Smuggling in hyper
0.12.0 - 0.12.35 and 0.13.0 - 0.13.9 and 0.14.0 - 0.14.2 GHSA-6hfq-h8hq-87mf
0.12.0 - 0.12.35 and 0.13.0 - 0.13.9 and 0.14.0 - 0.14.2 GHSA-6hfq-h8hq-87mf
Critical
5 years ago
HTTP Request Smuggling in hyper
0.11.0 - 0.12.33 GHSA-h3qr-rq2j-74w4
0.11.0 - 0.12.33 GHSA-h3qr-rq2j-74w4
Medium Risk
5 years ago
HTTPS MitM vulnerability due to lack of hostname verification
0.0.1 - 0.9.3 GHSA-9xjr-m6f3-v5wm
0.0.1 - 0.9.3 GHSA-9xjr-m6f3-v5wm
Medium Risk
5 years ago
Headers containing newline characters can split messages in hyper
0.0.1 - 0.9.17 and 0.10.0 - 0.10.1 GHSA-q89x-f52w-6hj2
0.0.1 - 0.9.17 and 0.10.0 - 0.10.1 GHSA-q89x-f52w-6hj2
Impacted packages
Timeline
Published
4 years ago
May 10, 2022 at 12:00 PM UTC
Fixed (0.14.12)
5 years ago
August 24, 2021 at 11:25 PM UTC
Last Modified
2 years ago
November 08, 2023 at 04:18 AM UTC