CVE-2021-45683

Name of the Vulnerable Software and Affected Versions: binjs io crate through 2021-01-03

Description: The issue is related to the Read method, which may read from uninitialized memory locations. Affected versions of the crate pass an uninitialized buffer to a user-provided Read implementation, allowing arbitrary Read implementations to read from the uninitialized buffer and potentially return incorrect numbers of bytes written to the buffer. This can produce undefined values, leading to undefined behavior.

Recommendations: For binjs io crate through 2021-01-03, consider restricting the use of the Read method until a patch is available to prevent reading from uninitialized memory locations. As a temporary workaround, avoid using arbitrary Read implementations that can read from the uninitialized buffer. At the moment, there is no information about a newer version that contains a fix for this issue.