{"action":"Upgrade claxon to 0.3.2 or later.","affected":[{"fixed":"0.3.2","introduced":"0.0.0-0"},{"fixed":"0.4.1","introduced":"0.4.0-0"}],"component":"claxon","cve_ids":["CVE-2018-20992"],"ecosystem":"crates.io","epss":0.01372,"exploited":false,"fixed_versions":["0.3.2","0.4.1"],"ghsa_id":"GHSA-8c6g-4xc5-w96c","id":"tcs_01M5KF550BQ8DKH96CSPBQ5PJ1","modified_at":"2023-11-08T04:00:13.431426Z","published_at":"2018-08-25T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2018-0004","https://crates.io/crates/claxon","https://rustsec.org/advisories/RUSTSEC-2018-0004.html","https://github.com/ruuda/claxon/commit/8f28ec275e412dd3af4f3cda460605512faf332c"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"RUSTSEC-2018-0004","url":"https://osv.dev/vulnerability/RUSTSEC-2018-0004"}],"summary":"Malicious input could cause uninitialized memory to be exposed"}