PT-2021-22000

CVE-2021-38192

Published

2021-07-08

Updated

2021-08-25

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: prost-types versions prior to 0.8.0

Description: An issue was discovered in the prost-types crate where an overflow can occur during conversion from Timestamp to SystemTime. This is caused by a bug that allows untrusted input to cause an overflow and panic during the conversion process.

Recommendations: To resolve the issue, upgrade to prost-types v0.8 and switch the usage of From<Timestamp> for SystemTime to TryFrom<Timestamp> for SystemTime.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-190: Integer Overflow or Wraparound

CWE-120: Buffer Copy without Checking Size of Input (\'Classic Buffer Overflow\')

Related identifiers

CVE-2021-38192

GHSA-X4QM-MCJQ-V2GF