Rusqlite
CVE-2020-35870
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API use-after-free.
AnalysisAI
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Use After Free (CWE-416), which allows attackers to access freed memory to execute arbitrary code or crash the application. An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API use-after-free. Affected products include: Rusqlite Project Rusqlite. Version information: before 0.23.0.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use smart pointers or garbage-collected languages. Set pointers to NULL after freeing. Enable memory sanitizers.
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. Rated high severit
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. Rated high severit
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. Rated high severit
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. Rated high severit
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. Rated high severit
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. Rated high severit
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. Rated high severit
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Rated critical severity (CVSS 9.8), this vulnerabi
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Rated critical severity (CVSS 9.8), this vulnerabi
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Rated critical severity (CVSS 9.8), this vulnerabi
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Rated critical severity (CVSS 9.8), this vulnerabi
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Rated critical severity (CVSS 9.8), this vulnerabi
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today