crítica
CVE-2021-28879
rust: integer overflow in the Zip implementation can lead to a buffer overflow
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, CBL-Mariner, Photon OS. Más baja según Red Hat (media), Amazon (media), Oracle (media), Rocky Linux (media), Ubuntu (media).
Descripción
In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. This bug can lead to a buffer overflow when a consumed Zip iterator is used again.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| CBL-Mariner 1.0 | rust | 0:1.47.0-2.cm1 |
| Photon OS 3.0 | rust | 1.51.0-2.ph3 |
| Photon OS 4.0 | rust | 1.51.0-2.ph4 |
| amazon linux 2 | cargo, cargo-doc, clippy y 10 más | 1.56.1-1.amzn2.0.1 |
| debian 10 | rustc | sin corrección indicada |
| debian 11 | rustc | sin corrección indicada |
| debian 12 | rustc | 1.53.0+dfsg1-1 |
| debian 13 | rustc | 1.53.0+dfsg1-1 |
| debian 14 | rustc | 1.53.0+dfsg1-1 |
| debian 9 | rustc | sin corrección indicada |
| echo | rustc | 1.53.0+dfsg1-1 |
| Oracle Linux 8 | cargo, cargo-doc, clippy y 11 más | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
Mostrar las 74 entradas de 19 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| CBL-Mariner 1.0 | rust | 0:1.47.0-2.cm1 |
| Photon OS 3.0 | rust | 1.51.0-2.ph3 |
| Photon OS 4.0 | rust | 1.51.0-2.ph4 |
| amazon linux 2 | cargo | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | cargo-doc | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | clippy | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | rls | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | rust | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | rust-analysis | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | rust-debugger-common | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | rust-debuginfo | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | rust-doc | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | rust-gdb | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | rust-src | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | rust-std-static | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | rustfmt | 1.56.1-1.amzn2.0.1 |
| debian 10 | rustc | sin corrección indicada |
| debian 11 | rustc | sin corrección indicada |
| debian 12 | rustc | 1.53.0+dfsg1-1 |
| debian 13 | rustc | 1.53.0+dfsg1-1 |
| debian 14 | rustc | 1.53.0+dfsg1-1 |
| debian 9 | rustc | sin corrección indicada |
| echo | rustc | 1.53.0+dfsg1-1 |
| Oracle Linux 8 | cargo | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | cargo-doc | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | clippy | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | rls | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | rust | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | rust-analysis | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | rust-debugger-common | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | rust-doc | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | rust-gdb | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | rust-lldb | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | rust-src | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | rust-std-static | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | rust-toolset | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | rustfmt | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| rapidfort ubuntu 20.04 | rf-rustc | 0:1.61.0+dfsg1-1~exp1ubuntu1 |
| rapidfort ubuntu 20.04 | rustc | 0:1.61.0+dfsg1-1~exp1ubuntu1, 0:1.68.0+dfsg0ubuntu1-0ubuntu1 |
| rapidfort ubuntu 22.04 | rf-rustc | 0:1.61.0+dfsg1-1~exp1ubuntu1 |
| rapidfort ubuntu 22.04 | rustc | 0:1.61.0+dfsg1-1~exp1ubuntu1, 0:1.68.0+dfsg0ubuntu1-0ubuntu1 |
| rapidfort ubuntu 24.04 | rf-rustc | 0:1.61.0+dfsg1-1~exp1ubuntu1 |
| rapidfort ubuntu 24.04 | rustc | 0:1.61.0+dfsg1-1~exp1ubuntu1, 0:1.68.0+dfsg0ubuntu1-0ubuntu1 |
| rocky 8 | cargo | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | cargo-doc | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | clippy | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rls | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-analysis | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-debugger-common | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-doc | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-gdb | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-lldb | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-src | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-std-static | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::cargo | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::cargo-doc | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::clippy | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::rls | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::rust | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::rust-analysis | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::rust-debugger-common | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::rust-doc | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::rust-gdb | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::rust-lldb | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::rust-src | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::rust-std-static | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::rust-toolset | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::rustfmt | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rustfmt | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| ubuntu 20.04 | rustc | 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1 |
| ubuntu 20.04-ESM | rustc | 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1 |
| ubuntu 22.04 | rustc | 1.53.0+dfsg1+llvm-4ubuntu1 |
Referencias
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-36323.json
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-28875.json
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-28876.json
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-28877.json
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-28878.json
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-28879.json
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-31162.json
- https://access.redhat.com/security/cve/CVE-2021-28879
Las 18 referencias
- https://github.com/rust-lang/rust/issues/82282
- https://github.com/rust-lang/rust/pull/82289
- https://linux.oracle.com/cve/CVE-2021-28879.html
- https://linux.oracle.com/errata/ELSA-2021-3063.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CZ337CM4GFJLRDFVQCGC7J25V65JXOG5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFUO3URYCO73D2Q4WYJBWAMJWGGVXQO4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZG65GUW6Z2CYOQHF7T3TB5CZKIX6ZJE/
- https://nvd.nist.gov/vuln/detail/CVE-2021-28879
- https://security.gentoo.org/glsa/202210-09
- https://www.cve.org/CVERecord?id=CVE-2021-28879