CVE-2021-38191 (Medium) detected in tokio-1.4.0.crate #13

mend-bolt-for-github · 2021-12-29T01:42:14Z

CVE-2021-38191 - Medium Severity Vulnerability

Vulnerable Library - tokio-1.4.0.crate

An event-driven, non-blocking I/O platform for writing asynchronous I/O backed applications.

Dependency Hierarchy:

reqwest-0.11.2.crate (Root Library)
- hyper-0.14.5.crate
  - ❌ tokio-1.4.0.crate (Vulnerable Library)

Found in base branch: master

Vulnerability Details

An issue was discovered in the tokio crate before 1.8.1 for Rust. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread.

Publish Date: 2021-08-08

CVSS 3 Score Details (5.9)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-08-08

Fix Resolution: tokio - 1.5.1,1.6.3,1.7.2, 1.8.1

Step up your Open Source Security Game with WhiteSource here

mend-bolt-for-github bot added the security vulnerability Security vulnerability detected by WhiteSource label Dec 29, 2021