Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2021-28879

critical

CVE-2021-28879

rust: integer overflow in the Zip implementation can lead to a buffer overflow

Published Modified CWE 190
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by NVD, CBL-Mariner, Photon OS. Rated lower by Red Hat (medium), Amazon (medium), Oracle (medium), Rocky Linux (medium), Ubuntu (medium).

Description

In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. This bug can lead to a buffer overflow when a consumed Zip iterator is used again.

Affected packages and fixed versions

SourcePackageFixed in
CBL-Mariner 1.0rust0:1.47.0-2.cm1
Photon OS 3.0rust1.51.0-2.ph3
Photon OS 4.0rust1.51.0-2.ph4
amazon linux 2cargo, cargo-doc, clippy and 10 more1.56.1-1.amzn2.0.1
debian 10rustcno fix listed
debian 11rustcno fix listed
debian 12rustc1.53.0+dfsg1-1
debian 13rustc1.53.0+dfsg1-1
debian 14rustc1.53.0+dfsg1-1
debian 9rustcno fix listed
echorustc1.53.0+dfsg1-1
Oracle Linux 8cargo, cargo-doc, clippy and 11 more1.52.1-1.module+el8.4.0+20287+5ada6442
Show all 74 entries from 19 sources
SourcePackageFixed in
CBL-Mariner 1.0rust0:1.47.0-2.cm1
Photon OS 3.0rust1.51.0-2.ph3
Photon OS 4.0rust1.51.0-2.ph4
amazon linux 2cargo1.56.1-1.amzn2.0.1
amazon linux 2cargo-doc1.56.1-1.amzn2.0.1
amazon linux 2clippy1.56.1-1.amzn2.0.1
amazon linux 2rls1.56.1-1.amzn2.0.1
amazon linux 2rust1.56.1-1.amzn2.0.1
amazon linux 2rust-analysis1.56.1-1.amzn2.0.1
amazon linux 2rust-debugger-common1.56.1-1.amzn2.0.1
amazon linux 2rust-debuginfo1.56.1-1.amzn2.0.1
amazon linux 2rust-doc1.56.1-1.amzn2.0.1
amazon linux 2rust-gdb1.56.1-1.amzn2.0.1
amazon linux 2rust-src1.56.1-1.amzn2.0.1
amazon linux 2rust-std-static1.56.1-1.amzn2.0.1
amazon linux 2rustfmt1.56.1-1.amzn2.0.1
debian 10rustcno fix listed
debian 11rustcno fix listed
debian 12rustc1.53.0+dfsg1-1
debian 13rustc1.53.0+dfsg1-1
debian 14rustc1.53.0+dfsg1-1
debian 9rustcno fix listed
echorustc1.53.0+dfsg1-1
Oracle Linux 8cargo1.52.1-1.module+el8.4.0+20287+5ada6442
Oracle Linux 8cargo-doc1.52.1-1.module+el8.4.0+20287+5ada6442
Oracle Linux 8clippy1.52.1-1.module+el8.4.0+20287+5ada6442
Oracle Linux 8rls1.52.1-1.module+el8.4.0+20287+5ada6442
Oracle Linux 8rust1.52.1-1.module+el8.4.0+20287+5ada6442
Oracle Linux 8rust-analysis1.52.1-1.module+el8.4.0+20287+5ada6442
Oracle Linux 8rust-debugger-common1.52.1-1.module+el8.4.0+20287+5ada6442
Oracle Linux 8rust-doc1.52.1-1.module+el8.4.0+20287+5ada6442
Oracle Linux 8rust-gdb1.52.1-1.module+el8.4.0+20287+5ada6442
Oracle Linux 8rust-lldb1.52.1-1.module+el8.4.0+20287+5ada6442
Oracle Linux 8rust-src1.52.1-1.module+el8.4.0+20287+5ada6442
Oracle Linux 8rust-std-static1.52.1-1.module+el8.4.0+20287+5ada6442
Oracle Linux 8rust-toolset1.52.1-1.module+el8.4.0+20287+5ada6442
Oracle Linux 8rustfmt1.52.1-1.module+el8.4.0+20287+5ada6442
rapidfort ubuntu 20.04rf-rustc0:1.61.0+dfsg1-1~exp1ubuntu1
rapidfort ubuntu 20.04rustc0:1.61.0+dfsg1-1~exp1ubuntu1, 0:1.68.0+dfsg0ubuntu1-0ubuntu1
rapidfort ubuntu 22.04rf-rustc0:1.61.0+dfsg1-1~exp1ubuntu1
rapidfort ubuntu 22.04rustc0:1.61.0+dfsg1-1~exp1ubuntu1, 0:1.68.0+dfsg0ubuntu1-0ubuntu1
rapidfort ubuntu 24.04rf-rustc0:1.61.0+dfsg1-1~exp1ubuntu1
rapidfort ubuntu 24.04rustc0:1.61.0+dfsg1-1~exp1ubuntu1, 0:1.68.0+dfsg0ubuntu1-0ubuntu1
rocky 8cargo1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8cargo-doc1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8clippy1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rls1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rust1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rust-analysis1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rust-debugger-common1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rust-doc1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rust-gdb1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rust-lldb1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rust-src1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rust-std-static1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rust-toolset1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rust-toolset:rhel8::cargo1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rust-toolset:rhel8::cargo-doc1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rust-toolset:rhel8::clippy1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rust-toolset:rhel8::rls1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rust-toolset:rhel8::rust1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rust-toolset:rhel8::rust-analysis1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rust-toolset:rhel8::rust-debugger-common1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rust-toolset:rhel8::rust-doc1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rust-toolset:rhel8::rust-gdb1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rust-toolset:rhel8::rust-lldb1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rust-toolset:rhel8::rust-src1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rust-toolset:rhel8::rust-std-static1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rust-toolset:rhel8::rust-toolset1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rust-toolset:rhel8::rustfmt1.52.1-1.module+el8.4.0+641+ca238f88
rocky 8rustfmt1.52.1-1.module+el8.4.0+641+ca238f88
ubuntu 20.04rustc1.53.0+dfsg1+llvm-4ubuntu1~20.04.1
ubuntu 20.04-ESMrustc1.53.0+dfsg1+llvm-4ubuntu1~20.04.1
ubuntu 22.04rustc1.53.0+dfsg1+llvm-4ubuntu1

References

All 18 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.