CVE-2021-26951
Critical
Description
An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::set_len is used without proper memory claiming, and this uninitialized memory is used for a user-provided Read operation, as demonstrated by Sectors::get.
SeverityCritical
CVSS9.8
Exploit probability—
ProductCalamine
PublishedFeb 9, 2021
First seenFeb 9, 2021
How to fix
Update
- calamine_project calamine0.17.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| calamine_project calamine | v < 0.17.0 | 0.17.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.