From 11ef671de711a18ba57857086557f0e764403b96 Mon Sep 17 00:00:00 2001 From: Joshua Liebow-Feeser Date: Thu, 14 Dec 2023 14:29:20 -0600 Subject: [PATCH 1/2] [yanks] Document yanks for #716 --- CHANGELOG.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4611a1d8b3..ba9f5d3f15 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,19 @@ Releases](https://github.com/google/zerocopy/releases). ## Yanks and Regressions +### 0.2.2 through 0.2.8, 0.3.0 through 0.3.1, 0.4.0, 0.5.0, 0.6.0 through 0.6.5, 0.7.0 through 0.7.30 + +In these versions, the `Ref` methods `into_ref`, `into_mut`, `into_slice`, and +`into_mut_slice` were permitted in combination with the standard library +`cell::Ref` and `cell::RefMut` types for `Ref`'s `B` type parameter. These +combinations are unsound, and may permit safe code to exhibit undefined +behavior. Fixes have been published to each affected minor version which do not +permit this code to compile. + +See [#716][issue-716] for more details. + +[issue-716]: https://github.com/google/zerocopy/issues/716 + ### 0.7.27, 0.7.28 These versions were briefly yanked due to a non-soundness regression reported in From 62691a5dbdee548775956b847cc1e7e36726b506 Mon Sep 17 00:00:00 2001 From: Joshua Liebow-Feeser Date: Mon, 18 Dec 2023 07:57:49 -0800 Subject: [PATCH 2/2] [yanks] Add security advisory links --- CHANGELOG.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index ba9f5d3f15..c00b88c0d5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,9 @@ Releases](https://github.com/google/zerocopy/releases). ### 0.2.2 through 0.2.8, 0.3.0 through 0.3.1, 0.4.0, 0.5.0, 0.6.0 through 0.6.5, 0.7.0 through 0.7.30 +*Security advisories for this bug have been published as +[RUSTSEC-2023-0074][rustsec-advisory] and [GHSA-3mv5-343c-w2qg][github-advisory].* + In these versions, the `Ref` methods `into_ref`, `into_mut`, `into_slice`, and `into_mut_slice` were permitted in combination with the standard library `cell::Ref` and `cell::RefMut` types for `Ref`'s `B` type parameter. These @@ -18,6 +21,8 @@ permit this code to compile. See [#716][issue-716] for more details. +[rustsec-advisory]: https://rustsec.org/advisories/RUSTSEC-2023-0074.html +[github-advisory]: https://github.com/google/zerocopy/security/advisories/GHSA-3mv5-343c-w2qg [issue-716]: https://github.com/google/zerocopy/issues/716 ### 0.7.27, 0.7.28