CVE-2021-45690: 
Rust vulnerability analysis and mitigation

An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. The deserialize_binary function may read from uninitialized memory locations, which can lead to undefined behavior. The vulnerability was assigned CVE-2021-45690 and was reported on December 26, 2021 (NVD, RustSec).

The vulnerability exists in several deserialization functions that pass an uninitialized buffer to a user-provided Read instance, including deserialize_binary, deserialize_string, deserialize_extension_others, and deserialize_string_primitive. This implementation flaw can result in safe Read implementations reading from uninitialized memory buffers, leading to undefined behavior (RustSec). The vulnerability has been assigned a CVSS v3.1 base score of 9.8 CRITICAL with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability can result in unauthorized access to uninitialized memory locations, which could potentially expose sensitive information or lead to undefined behavior in applications using the affected crate (RustSec).

The vulnerability is considered easily exploitable as it requires no special privileges or user interaction. An unauthenticated attacker with network access can potentially exploit this vulnerability (NVD).

As of the last available information, there are no patched versions available for this vulnerability (RustSec).