CVE-2018-20991: RUSTSEC-2018-0003 - Possible double free during unwinding in SmallVec::insert_many

CVE-2018-20991 · Severity: low · CVSS 3 · Published 2018-07-19

Possible double free during unwinding in SmallVec::insert_many

Technologies: smallvec (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2018-20991 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2018-20991 being exploited in the wild.
How severe is CVE-2018-20991?
Low severity, with a CVSS score of 3, published 19 July 2018.
Which products and versions are affected?
smallvec (crates.io) SEMVER:introduced=0.3.2,fixed=0.3.4,introduced=0.4.0-0,fixed=0.4.5,introduced=0.5.0-0,fixed=0.5.1,introduced=0.6.0-0,fixed=0.6.3, SEMVER:introduced=0.3.2,fixed=0.6.3.
Is there a fix for CVE-2018-20991?
Yes. smallvec (crates.io): upgrade to 0.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2018-20991?
Check whether you run smallvec (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • smallvec (crates.io): upgrade to 0.6.3 or later
    cargo update -p smallvec

Affected products

  • smallvec (crates.io) SEMVER:introduced=0.3.2,fixed=0.3.4,introduced=0.4.0-0,fixed=0.4.5,introduced=0.5.0-0,fixed=0.5.1,introduced=0.6.0-0,fixed=0.6.3, SEMVER:introduced=0.3.2,fixed=0.6.3

Identifiers

  • CVE-2018-20991
  • GHSA-rxr4-x558-x7hw
  • RUSTSEC-2018-0003

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.