crates.io/capnp CVE-2022-46149: unknown, EPSS 0.93%
out-of-bounds read possible when setting list-of-pointers
Action: Upgrade capnp to 0.13.7 or later.
cargo update -p capnp --precise 0.13.7cargo update -p capnp --precise 0.14.11cargo update -p capnp --precise 0.15.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.0.0-0 | 0.13.7 | - |
| 0.14.0-0 | 0.14.11 | - |
| 0.15.0-0 | 0.15.2 | - |
Fixed versions
| 0.13.7 | 0.14.11 | 0.15.2 |
Sources
- osv: RUSTSEC-2022-0068
- https://crates.io/crates/capnp
- https://rustsec.org/advisories/RUSTSEC-2022-0068.html
- https://github.com/capnproto/capnproto/tree/master/security-advisories/2022-11-30-0-pointer-list-bounds.md
- https://dwrensha.github.io/capnproto-rust/2022/11/30/out_of_bounds_memory_access_bug.html
- https://github.com/capnproto/capnproto/security/advisories/GHSA-qqff-4vw4-f6hx
CVE-2022-46149 · published · modified · JSON