CVE-2020-36454

Name of the Vulnerable Software and Affected Versions parc crate through 2020-11-14

Description An issue in the parc crate allows concurrent access to a non-Sync T, which can cause undefined behavior like data races. This is due to LockWeak unconditionally implementing Send without trait bounds on T, despite not owning T and only providing &T.

Recommendations For parc crate through 2020-11-14, consider restricting the use of LockWeak to prevent concurrent access to non-Sync T until a patch is available. As a temporary workaround, ensure that T implements Sync to prevent data races. At the moment, there is no information about a newer version that contains a fix for this vulnerability.