socket2 Crate up to 0.3.15 on Rust std::net::SocketAddr memory corruption

Summaryinfo

A vulnerability was found in socket2 Crate up to 0.3.15 on Rust. It has been declared as critical. The impacted element is the function std::net::SocketAddr. Executing a manipulation can lead to memory corruption. This vulnerability is tracked as CVE-2020-35920. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in socket2 Crate up to 0.3.15 on Rust (Rust Package) and classified as critical. This vulnerability affects the function std::net::SocketAddr. The manipulation with an unknown input leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was disclosed 12/31/2020 as RUSTSEC-2020-0079. The advisory is shared for download at rustsec.org. This vulnerability was named CVE-2020-35920. There are known technical details, but no exploit is available.

Upgrading to version 0.3.16 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Rust Package

Name

• socket2 Crate

Version

• 0.3.0
• 0.3.1
• 0.3.2
• 0.3.3
• 0.3.4
• 0.3.5
• 0.3.6
• 0.3.7
• 0.3.8
• 0.3.9
• 0.3.10
• 0.3.11
• 0.3.12
• 0.3.13
• 0.3.14
• 0.3.15

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion