GitHub Advisoryadvisory · crates.io

GHSA-xpp3-xrff-w6rh rocksdb vulnerable to out-of-bounds read

MEDIUM Published 2022-08-12 Modified 2022-08-12 Official page ↗

Ecosystem: crates.io
Packages: rocksdb
Severity: Moderate
Reviewed: 2022-08-12

Affected packages

• crates.io rocksdb: < 0.19.0 → fixed in 0.19.0

Description

Affected versions of this crate called the RocksDB C API `rocksdb_open_column_families_with_ttl()` with a pointer to a single integer TTL value, but one TTL value for each column family is expected. This is only relevant when using `rocksdb::DBWithThreadMode::open_cf_descriptors_with_ttl()` with multiple column families. This bug has been fixed in v0.19.0.

References

https://github.com/rust-rocksdb/rust-rocksdb/pull/616 web
https://github.com/rust-rocksdb/rust-rocksdb package
https://github.com/rust-rocksdb/rust-rocksdb/releases/tag/v0.19.0 web
https://rustsec.org/advisories/RUSTSEC-2022-0046.html web