CVE-2020-36445

Name of the Vulnerable Software and Affected Versions convec crate through 2020-11-24

Description The issue allows users to insert types that are not Send or not Sync into ConVec<T>, enabling the creation of data races. This can be achieved by using non-Send types like Arc<Cell< >> or Rc< > as T in ConVec<T>, or by using types like Cell< > or RefCell< > as T, which are Send but not Sync. Such data races can lead to memory corruption.

Recommendations For the convec crate through 2020-11-24, consider avoiding the use of non-Send or non-Sync types as T in ConVec<T> to prevent data races. As a temporary workaround, restrict the use of ConVec<T> with types that are not Send or Sync until a fix is available.