Subject: Re: bug#47544: rust-slice-deque is vulnerable to CVE-2021-29938

From: Maxim Cournoyer <[email-masked]>
Date: Tue, 22 Mar 2022 22:39:11 -0400

Hello,

Léo Le Bouter <[email-masked]> writes:

> CVE-2021-29938	07:15
> An issue was discovered in the slice-deque crate through 2021-02-19 for
> Rust. A double drop can occur in SliceDeque::drain_filter upon a panic
> in a predicate function.
>
> Upstream PR: https://github.com/gnzlbg/slice_deque/pull/91

The project appears unmaintained [0].

[0]  https://github.com/gnzlbg/slice_deque/issues/94.

It's used by a couple other packages (how many?  hard to tell, this
being Rust in Guix).

Thanks,

Maxim