Rust advisories / cgc
Vulnerability MediumRUSTSEC-2020-0148 · cgc
RUSTSEC-2020-0148: Multiple soundness issues in `Ptr`
Short answerA security vulnerability in the cgc crate: Multiple soundness issues in `Ptr`. Medium severity (CVSS 5.9). No fixed version: replace the crate or remove the affected code path.
| Crate | cgc |
|---|---|
| Type | Vulnerability (memory-corruption) |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | Medium, CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Published | 2020-12-10 |
| Last changed | 2024-03-15 |
| Also known as | CVE-2020-36466, CVE-2020-36467, CVE-2020-36468, GHSA-f3mq-99jr-ww4r, GHSA-f9xr-3m55-5q2v, GHSA-pwhf-7427-9vv2 |
What to do
- Find who pulls it in:
cargo tree -i cgc. - Avoid the affected API, or replace the crate.
Details from the advisory
Affected versions of this crate have the following issues:
1. Ptr implements Send and Sync for all types, this can lead to data races by sending non-thread safe types across threads.
2. Ptr::get violates mutable alias rules by returning multiple mutable references to the same object.
3. Ptr::write uses non-atomic writes to the underlying pointer. This means that when used across threads it can lead to data races.
References
- Package: crates.io/crates/cgc
- Advisory: rustsec.org/advisories/RUSTSEC-2020-0148.html
- Report: github.com/playXE/cgc/issues/5
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?