{"id":"GHSA-5j8w-r7g8-5472","summary":"Arrow2 allows double free in `safe` code","details":"The struct `Ffi_ArrowArray` implements `#derive(Clone)` that is inconsistent with\nits custom implementation of `Drop`, resulting in a double free when cloned.\n\nCloning this struct in `safe` results in a segmentation fault, which is unsound.\n\nThis derive was removed from this struct. All users are advised to either:\n* bump the patch version of this crate (for versions `v0.7,v0.8,v0.9`), or\n* migrate to a more recent version of  the crate (when using `\u003c0.7`).\n\nDoing so elimitates this vulnerability (code no longer compiles).\n","aliases":["RUSTSEC-2022-0012"],"modified":"2023-11-08T04:15:47.037496Z","published":"2022-06-16T23:42:08Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2022-06-16T23:42:08Z","nvd_published_at":null,"cwe_ids":["CWE-415"]},"references":[{"type":"WEB","url":"https://github.com/jorgecarleitao/arrow2/issues/880"},{"type":"PACKAGE","url":"https://github.com/jorgecarleitao/arrow2"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2022-0012.html"}],"affected":[{"package":{"name":"arrow2","ecosystem":"crates.io","purl":"pkg:cargo/arrow2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.7.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-5j8w-r7g8-5472/GHSA-5j8w-r7g8-5472.json"}},{"package":{"name":"arrow2","ecosystem":"crates.io","purl":"pkg:cargo/arrow2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.8.0"},{"fixed":"0.8.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-5j8w-r7g8-5472/GHSA-5j8w-r7g8-5472.json"}},{"package":{"name":"arrow2","ecosystem":"crates.io","purl":"pkg:cargo/arrow2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.9.0"},{"fixed":"0.9.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-5j8w-r7g8-5472/GHSA-5j8w-r7g8-5472.json"}}],"schema_version":"1.9.0"}