GitHub Advisoryadvisory · crates.io

GHSA-gv73-9mwv-fwgq Out of bounds write in prost

CRITICAL Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2020-35858
Ecosystem
crates.io
Packages
prost
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-787
Reviewed
2021-08-19

Affected packages

• crates.io prost: < 0.6.1 → fixed in 0.6.1

Description

Affected versions of this crate contained a bug in which decoding untrusted input could overflow the stack. On architectures with stack probes (like x86), this can be used for denial of service attacks, while on architectures without stack probes (like ARM) overflowing the stack is unsound and can result in potential memory corruption (or even RCE).

Related

Alias · CVE (1)

  • CVE-2020-35858 An issue was discovered in the prost crate before 0.6.1 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-787 Out-of-bounds Write weakness

References