{"action":"Upgrade capnp to 0.13.7 or later.","affected":[{"fixed":"0.15.2","introduced":"0.15.0"},{"fixed":"0.14.11","introduced":"0.14.0"},{"fixed":"0.13.7","introduced":"0"}],"component":"capnp","cve_ids":["CVE-2022-46149"],"ecosystem":"crates.io","epss":0.00932,"exploited":false,"fixed_versions":["0.15.2","0.14.11","0.13.7"],"ghsa_id":"GHSA-qqff-4vw4-f6hx","id":"tcs_01M5KF2Q6C4SFZSXPYWVDG600J","modified_at":"2023-11-08T04:10:54.980908Z","published_at":"2022-12-05T17:58:16Z","references":["https://osv.dev/vulnerability/GHSA-qqff-4vw4-f6hx","https://github.com/capnproto/capnproto/security/advisories/GHSA-qqff-4vw4-f6hx","https://nvd.nist.gov/vuln/detail/CVE-2022-46149","https://github.com/capnproto/capnproto/commit/25d34c67863fd960af34fc4f82a7ca3362ee74b9","https://dwrensha.github.io/capnproto-rust/2022/11/30/out_of_bounds_memory_access_bug.html","https://github.com/capnproto/capnproto","https://github.com/capnproto/capnproto/tree/master/security-advisories/2022-11-30-0-pointer-list-bounds.md","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EAHKLUMJAXJEV5BPBS5XXWBQ3ZTHGOLY","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PTS6TWD6K2NKXLEEFBPROQXMOFUTEYWY","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WKXM4JAFXLTXU5IQB3OUBQVCIICZWGYX","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZOCQQOPMVQOFUWBWAGVGN76OYAV3WXY4","https://rustsec.org/advisories/RUSTSEC-2022-0068.html"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-qqff-4vw4-f6hx","url":"https://osv.dev/vulnerability/GHSA-qqff-4vw4-f6hx"}],"summary":"Cap'n Proto and its Rust implementation vulnerable to out-of-bounds read due to logic error handling list-of-list"}