{"action":"Upgrade borsh to 0.10.4 or later.","affected":[{"fixed":"0.10.4","introduced":"0.0.0-0"},{"fixed":"1.0.0-alpha.1","introduced":"0.11.0-0"}],"component":"borsh","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.10.4","1.0.0-alpha.1"],"ghsa_id":"GHSA-fjx5-qpf4-xjf2","id":"tcs_01M5KF8E921MTRB8C3FEVWX39R","modified_at":"2024-09-23T15:02:17Z","published_at":"2023-04-12T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2023-0033","https://crates.io/crates/borsh","https://rustsec.org/advisories/RUSTSEC-2023-0033.html","https://github.com/near/borsh-rs/issues/19","https://github.com/near/borsh-rs/pull/136"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"RUSTSEC-2023-0033","url":"https://osv.dev/vulnerability/RUSTSEC-2023-0033"}],"summary":"Parsing borsh messages with ZST which are not-copy/clone is unsound"}