VDB
GHSA-wwq9-3cpr-mm53
GHSA-wwq9-3cpr-mm53
PUBLISHED
CVSS 9.800000190734863 CRITICAL
Borsh serialization of HashMap is non-canonical
Record from GitHub Advisory Database · Published December 4, 2024
hashbrown is fixed in 0.15.1 (crates.io)
Borsh serialization of HashMap is non-canonical
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| hashbrown | crates.io | 0.15.1 |
| xh | Chainguard | 0.23.1-r0 |
| pixi | Chainguard | 0.39.4-r0 |
| wit-bindgen | Chainguard | 0.36.0-r1 |
| starship | Wolfi | 1.21.1-r1 |
| wit-bindgen | Wolfi | 0.36.0-r1 |
| nushell | Chainguard | 0.101.0-r0 |
| qdrant | Chainguard | 1.12.5-r0 |
| linkerd2-proxy | Wolfi | 2.271.0-r0 |
| nushell | Wolfi | 0.101.0-r0 |
| cedar | Wolfi | 4.2.2-r0 |
| wash | Wolfi | 0.37.0-r1 |
25 more packages have a fixed version. See every fix in Lookup.
Risk scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | xh | 0 |
| chainguard | pixi | 0 |
| chainguard | wit-bindgen | 0 |
| wolfi | starship | 0 |
| wolfi | wit-bindgen | 0 |
| chainguard | nushell | 0 |
| chainguard | qdrant | 0 |
| wolfi | linkerd2-proxy | 0 |
| wolfi | nushell | 0 |
| wolfi | cedar | 0 |
| wolfi | wash | 0 |
| crates.io | hashbrown | 0.15.0 |
| chainguard | berg | 0 |
| chainguard | starship | 0 |
| chainguard | wash | 0 |
| chainguard | wadm | 0 |
| wolfi | pixi | 0 |
| wolfi | qdrant | 0 |
| chainguard | buck2 | 0 |
| wolfi | cargo-audit | 0 |
…and 17 more
Timeline
- Dec 4, 2024 CVE Published
- Dec 4, 2024 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-wwq9-3cpr-mm53
vulnetix vdb fixes GHSA-wwq9-3cpr-mm53Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-wwq9-3cpr-mm53/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart