{"id":"GHSA-48m6-wm5p-rr6h","aliases":["RUSTSEC-2023-0070"],"status":"published","title":"Insufficient covariance check makes self_cell unsound","description":"All public versions prior to `1.02` used an insufficient check to ensure that users correctly marked the dependent type as either `covariant` or `not_covariant`. This allowed users to mark a dependent as covariant even though its type was not covariant but invariant, for certain invariant types involving trait object lifetimes. One example for such a dependent type is `type Dependent\u003c'a\u003e = RefCell\u003cBox\u003cdyn fmt::Display + 'a\u003e\u003e`. Such a type allowed unsound usage in purely safe user code that leads to undefined behavior. The patched versions now produce a compile time error if such a type is marked as `covariant`.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-11-10T12:00:00Z","modified":"2024-02-10T16:26:48Z","fixes":[{"ecosystem":"crates.io","package":"self_cell","fixed_in":["0.10.3","1.0.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"self_cell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.3"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"self_cell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"self_cell","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.10.3"}]}]},{"source":"osv","ecosystem":"crates.io","package":"self_cell","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"self_cell","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.10.3"},{"introduced":"1.0.0"},{"fixed":"1.0.2"}]}]}],"references":[{"url":"https://github.com/Voultapher/self_cell/issues/49","tags":["web","report"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0070.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-48m6-wm5p-rr6h"},{"url":"https://github.com/Voultapher/self_cell","tags":["package"]},{"url":"https://crates.io/crates/self_cell","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-48m6-wm5p-rr6h","title":"Insufficient covariance check makes self_cell unsound","description":"All public versions prior to `1.02` used an insufficient check to ensure that users correctly marked the dependent type as either `covariant` or `not_covariant`. This allowed users to mark a dependent as covariant even though its type was not covariant but invariant, for certain invariant types involving trait object lifetimes. One example for such a dependent type is `type Dependent\u003c'a\u003e = RefCell\u003cBox\u003cdyn fmt::Display + 'a\u003e\u003e`. Such a type allowed unsound usage in purely safe user code that leads to undefined behavior. The patched versions now produce a compile time error if such a type is marked as `covariant`.","status":"published","published":"2023-11-14T18:32:20Z","modified":"2023-11-14T18:32:22Z","updated_at":"2026-11-02T14:37:22.040291Z"}],"osv":[{"id":"GHSA-48m6-wm5p-rr6h","title":"Insufficient covariance check makes self_cell unsound","description":"All public versions prior to `1.02` used an insufficient check to ensure that users correctly marked the dependent type as either `covariant` or `not_covariant`. This allowed users to mark a dependent as covariant even though its type was not covariant but invariant, for certain invariant types involving trait object lifetimes. One example for such a dependent type is `type Dependent\u003c'a\u003e = RefCell\u003cBox\u003cdyn fmt::Display + 'a\u003e\u003e`. Such a type allowed unsound usage in purely safe user code that leads to undefined behavior. The patched versions now produce a compile time error if such a type is marked as `covariant`.","status":"published","published":"2023-11-14T18:32:20Z","modified":"2024-02-10T16:26:48.155893Z","updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"RUSTSEC-2023-0070","title":"Insufficient covariance check makes self_cell unsound","description":"All public versions prior to `1.02` used an insufficient check to ensure that\nusers correctly marked the dependent type as either `covariant` or\n`not_covariant`. This allowed users to mark a dependent as covariant even though\nits type was not covariant but invariant, for certain invariant types involving\ntrait object lifetimes. One example for such a dependent type is `type\nDependent\u003c'a\u003e = RefCell\u003cBox\u003cdyn fmt::Display + 'a\u003e\u003e`. Such a type allowed\nunsound usage in purely safe user code that leads to undefined behavior. The\npatched versions now produce a compile time error if such a type is marked as\n`covariant`.","status":"published","published":"2023-11-10T12:00:00Z","modified":"2024-02-10T16:26:48.155893Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}