CVE-2021-45684

Name of the Vulnerable Software and Affected Versions: flumedb crate through 2021-01-07

Description: The issue allows arbitrary Read implementations to read from an uninitialized buffer, potentially exposing memory and returning incorrect byte counts. This can lead to undefined behavior due to the reading of uninitialized memory locations. The affected functions are go offset log::read entry() and offset log::read entry().

Recommendations: For versions of the flumedb crate through 2021-01-07, consider restricting the use of the go offset log::read entry() and offset log::read entry() functions until a patch is available to prevent arbitrary Read implementations from accessing uninitialized buffers. At the moment, there is no information about a newer version that contains a fix for this vulnerability.