{"id":"GHSA-v363-rrf2-5fmj","aliases":["RUSTSEC-2024-0001"],"status":"published","title":"ferris-says has undefined behavior when not using UTF-8","description":"Affected versions receive a `\u0026[u8]` from the caller through a safe API, and pass it directly to the unsafe `str::from_utf8_unchecked` function.\n\nThe behavior of `ferris_says::say` is undefined if the bytes from the caller don't happen to be valid UTF-8.\n\nThe flaw was corrected in [ferris-says#21] by using the safe `str::from_utf8` instead, and returning an error on invalid input. However this fix has not yet been published to crates.io as a patch version for 0.2.\n\nSeparately, [ferris-says#32] has introduced a different API for version 0.3 which accepts input as `\u0026str` rather than `\u0026[u8]`, so is unaffected by this bug.\n\n[ferris-says#21]: https://github.com/rust-lang/ferris-says/pull/21\n[ferris-says#32]: https://github.com/rust-lang/ferris-says/pull/32","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-01-13T12:00:00Z","modified":"2024-02-10T16:26:48Z","fixes":[{"ecosystem":"crates.io","package":"ferris-says","fixed_in":["0.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"ferris-says","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.2"},{"last_affected":"0.2.1"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"ferris-says","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0"},{"fixed":"0.3.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"ferris-says","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.2"},{"last_affected":"0.2.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"ferris-says","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0"},{"fixed":"0.3.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"ferris-says","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.3-0"},{"fixed":"0.3.1"}]}]}],"references":[{"url":"https://github.com/rust-lang/ferris-says/pull/21","tags":["web"]},{"url":"https://github.com/rust-lang/ferris-says/commit/bb661f29e0d88968c495a4ea4dc63ff0e2c2c11a","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0001.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-v363-rrf2-5fmj"},{"url":"https://github.com/mgattozzi/ferris-says","tags":["package"]},{"url":"https://crates.io/crates/ferris-says","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-v363-rrf2-5fmj","title":"ferris-says has undefined behavior when not using UTF-8","description":"Affected versions receive a `\u0026[u8]` from the caller through a safe API, and pass it directly to the unsafe `str::from_utf8_unchecked` function.\n\nThe behavior of `ferris_says::say` is undefined if the bytes from the caller don't happen to be valid UTF-8.\n\nThe flaw was corrected in [ferris-says#21] by using the safe `str::from_utf8` instead, and returning an error on invalid input. However this fix has not yet been published to crates.io as a patch version for 0.2.\n\nSeparately, [ferris-says#32] has introduced a different API for version 0.3 which accepts input as `\u0026str` rather than `\u0026[u8]`, so is unaffected by this bug.\n\n[ferris-says#21]: https://github.com/rust-lang/ferris-says/pull/21\n[ferris-says#32]: https://github.com/rust-lang/ferris-says/pull/32","status":"published","published":"2024-01-17T20:31:11Z","modified":"2024-01-17T20:31:12Z","updated_at":"2026-11-02T14:37:31.550603Z"}],"osv":[{"id":"GHSA-v363-rrf2-5fmj","title":"ferris-says has undefined behavior when not using UTF-8","description":"Affected versions receive a `\u0026[u8]` from the caller through a safe API, and pass it directly to the unsafe `str::from_utf8_unchecked` function.\n\nThe behavior of `ferris_says::say` is undefined if the bytes from the caller don't happen to be valid UTF-8.\n\nThe flaw was corrected in [ferris-says#21] by using the safe `str::from_utf8` instead, and returning an error on invalid input. However this fix has not yet been published to crates.io as a patch version for 0.2.\n\nSeparately, [ferris-says#32] has introduced a different API for version 0.3 which accepts input as `\u0026str` rather than `\u0026[u8]`, so is unaffected by this bug.\n\n[ferris-says#21]: https://github.com/rust-lang/ferris-says/pull/21\n[ferris-says#32]: https://github.com/rust-lang/ferris-says/pull/32","status":"published","published":"2024-01-17T20:31:11Z","modified":"2024-02-10T16:26:48.909247Z","updated_at":"2026-11-02T15:46:56.639206Z"},{"id":"RUSTSEC-2024-0001","title":"Unsound use of str::from_utf8_unchecked on bytes which are not UTF-8","description":"Affected versions receive a `\u0026[u8]` from the caller through a safe API, and pass\nit directly to the unsafe `str::from_utf8_unchecked` function.\n\nThe behavior of `ferris_says::say` is undefined if the bytes from the caller\ndon't happen to be valid UTF-8.\n\nThe flaw was corrected in [ferris-says#21] by using the safe `str::from_utf8`\ninstead, and returning an error on invalid input. However this fix has not yet\nbeen published to crates.io as a patch version for 0.2.\n\nSeparately, [ferris-says#32] has introduced a different API for version 0.3\nwhich accepts input as `\u0026str` rather than `\u0026[u8]`, so is unaffected by this bug.\n\n[ferris-says#21]: https://github.com/rust-lang/ferris-says/pull/21\n[ferris-says#32]: https://github.com/rust-lang/ferris-says/pull/32","status":"published","published":"2024-01-13T12:00:00Z","modified":"2024-02-10T16:26:48.909247Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}