GHSA-8r7q-r9mx-35rh

Mishandling of format strings in rusqlite

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-35869

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	rusqlite	< 0.23.0	0.23.0

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because rusqlite::trace::log mishandles format strings.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-35869 advisory
https://github.com/rusqlite/rusqlite/commit/2327d3b774927fdf48903c0bdc1ca7ec93c7c8d0 web
https://github.com/rusqlite/rusqlite package
https://github.com/rusqlite/rusqlite/releases/tag/0.23.0 web
https://rustsec.org/advisories/RUSTSEC-2020-0014.html web