{
  "schema_version": "1.4.0",
  "id": "GHSA-fqq2-xp7m-xvm8",
  "modified": "2021-08-24T17:45:32Z",
  "published": "2021-08-25T20:58:19Z",
  "aliases": [
    "CVE-2020-36435"
  ],
  "summary": "Data race in ruspiro-singleton",
  "details": "`Singleton<T>` is meant to be a static object that can be initialized lazily. In\norder to satisfy the requirement that `static` items must implement `Sync`,\n`Singleton` implemented both `Sync` and `Send` unconditionally.\n\nThis allows for a bug where non-`Sync` types such as `Cell` can be used in\nsingletons and cause data races in concurrent programs.\n\nThe flaw was corrected in commit `b0d2bd20e` by adding trait bounds, requiring\nthe contaiend type to implement `Sync`.\n",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "ruspiro-singleton"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.1"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36435"
    },
    {
      "type": "WEB",
      "url": "https://github.com/RusPiRo/ruspiro-singleton/issues/10"
    },
    {
      "type": "WEB",
      "url": "https://github.com/RusPiRo/ruspiro-singleton/pull/11"
    },
    {
      "type": "WEB",
      "url": "https://github.com/RusPiRo/ruspiro-singleton/commit/b0d2bd20eb40b9cbc2958b981ba2dcd9e6f9396e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/RusPiRo/ruspiro-singleton"
    },
    {
      "type": "WEB",
      "url": "https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/ruspiro-singleton/RUSTSEC-2020-0115.md"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2020-0115.html"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119",
      "CWE-362"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-18T20:14:26Z",
    "nvd_published_at": "2021-08-08T06:15:00Z"
  }
}