critical9.8
CVE-2020-35869
Mishandling of format strings in rusqlite
Impact
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because rusqlite::trace::log mishandles format strings.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | rusqlite | < 0.23.0 | 0.23.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rusqlite Project | Rusqlite | before 0.23.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/rusqlite/rusqlite/releases/tag/0.23.0
- https://rustsec.org/advisories/RUSTSEC-2020-0014.html
- https://github.com/advisories/GHSA-8r7q-r9mx-35rh
- https://nvd.nist.gov/vuln/detail/CVE-2020-35869
- https://github.com/rusqlite/rusqlite/commit/2327d3b774927fdf48903c0bdc1ca7ec93c7c8d0