{"id":"GHSA-ghc8-5cgm-5rpf","summary":"Inventory fails to prohibit standard library access prior to initialization of Rust standard library runtime","details":"Affected versions allow arbitrary caller-provided code to execute before the lifetime of `main`.\n\nIf the caller-provided code accesses particular pieces of the standard library that require an initialized Rust runtime, such as `std::io` or `std::thread`, these may not behave as documented. Panics are likely; UB is possible.\n\nThe flaw was corrected by enforcing that only code written within the `inventory` crate, which is guaranteed not to access runtime-dependent parts of the standard library, runs before `main`. Caller-provided code is restricted to running at compile time.\n","aliases":["RUSTSEC-2023-0057"],"modified":"2024-02-10T16:26:48.633370Z","published":"2023-09-11T20:43:17Z","database_specific":{"nvd_published_at":null,"cwe_ids":[],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2023-09-11T20:43:17Z"},"references":[{"type":"WEB","url":"https://github.com/dtolnay/inventory/pull/43"},{"type":"WEB","url":"https://github.com/dtolnay/inventory/commit/b853350a3800e38d2cb9950355b80bc8b8d3959c"},{"type":"PACKAGE","url":"https://github.com/dtolnay/inventory"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2023-0057.html"}],"affected":[{"package":{"name":"inventory","ecosystem":"crates.io","purl":"pkg:cargo/inventory"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-ghc8-5cgm-5rpf/GHSA-ghc8-5cgm-5rpf.json"}}],"schema_version":"1.9.0"}